CVEs published January 30, 2023
102 CVEs were published on January 30, 2023: 16 critical, 32 high. 1 is now in CISA KEV.
- Published
- 102
- Critical
- 16
- High
- 32
- Medium
- 52
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 55
Most affected products
- Schneider Electric IGSS Data Server
- 8
- HP PC BIOS
- 5
- Lenovo BIOS
- 4
- Schneider Electric Data Center Expert
- 4
- Snap One Wattbox WB-300-IP-3
- 4
- HP Support Assistant
- 3
- Schneider Electric Conext™ ComBox
- 3
- Schneider Electric EcoStruxure Power Commission
- 3
- FL3R FeelBox
- 2
- FreshTomato · Siretta QUARTZ-GOLD
- 2
Critical 16
- CVE-2022-4395Membership For WooCommerce < 2.1.7 - Unauthenticated Arbitrary File UploadMembership For WooCommerce
- CVE-2022-42484An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5.FreshTomato · Siretta QUARTZ-GOLD
- CVE-2022-27596Vulnerability in QTSQNAP Systems QuTS hero · QNAP Systems QTS
- CVE-2022-23334The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers
- CVE-2022-32513A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brutSchneider Electric C-Bus Network Automation Controller,… +4
- CVE-2022-32514A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web pSchneider Electric C-Bus Network Automation Controller,… +4
- CVE-2022-32522A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiSchneider Electric IGSS Data Server
- CVE-2022-32523A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiSchneider Electric IGSS Data Server
- CVE-2022-32524A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiSchneider Electric IGSS Data Server
- CVE-2022-32525A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiSchneider Electric IGSS Data Server
- CVE-2022-32526A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiSchneider Electric IGSS Data Server
- CVE-2022-32527A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiSchneider Electric IGSS Data Server
- CVE-2022-32529A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadiSchneider Electric IGSS Data Server
- CVE-2022-48006An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.
- CVE-2022-48175Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dash
- CVE-2023-24612The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
High 32
- CVE-2023-24020 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a loSnap One Wattbox WB-300-IP-3
- CVE-2022-34885An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbMotorola MR2600 Router
- CVE-2021-3439HP has identified a potential vulnerability in BIOS firmware of some Workstation products.HP PC BIOS
- CVE-2022-23455Potential security vulnerabilities have been identified in HP Support Assistant.HP Support Assistant
- CVE-2022-23454Potential security vulnerabilities have been identified in HP Support Assistant.HP Support Assistant
- CVE-2022-23453Potential security vulnerabilities have been identified in HP Support Assistant.HP Support Assistant
- CVE-2022-34884A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsLenovo XClarity Controller
- CVE-2022-27537Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escHP PC BIOS
- CVE-2021-3809Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary HP PC BIOS
- CVE-2021-3808Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary HP PC BIOS
- CVE-2022-27538A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow aHP PC BIOS
- CVE-2022-4680Revive Old Posts – Social Media Auto Post and Scheduling Plugin < 9.0.11 - PHP Object InjectionRevive Old Posts
- CVE-2022-4794AAWP < 3.12.3 - Unsafe URL HandlingAAWP
- CVE-2022-3990HPSFViewer might allow Escalation of Privilege.HPSFViewer
- CVE-2023-24830Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorizationApache Software Foundation Apache IoTDB Workbench · apache-…
- CVE-2022-26872Password reset interception via APIAMI MegaRAC SPx-12 · AMI MegaRAC SPx-13
- CVE-2023-0240Use after free in io_uring in the Linux KernelLinux Kernel
- CVE-2023-0266Use after free in SNDRV_CTL_IOCTL_ELEM in Linux KernelLinux Kernel
- CVE-2022-25936Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable.servst
- CVE-2022-25967Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variableeta
- CVE-2022-32515A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over Schneider Electric Conext™ ComBox
- CVE-2022-32516A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop Schneider Electric Conext™ ComBox
- CVE-2022-32518A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed oSchneider Electric Data Center Expert
- CVE-2022-32519A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when perforSchneider Electric Data Center Expert
- CVE-2022-32520A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed oSchneider Electric Data Center Expert
- CVE-2022-32521A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely Schneider Electric Data Center Expert
- CVE-2022-32528 A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files Schneider Electric IGSS Data Server
- CVE-2022-32747A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitatSchneider Electric EcoStruxure™ Cybersecurity Admin Expert
- CVE-2022-32748A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when usingSchneider Electric EcoStruxure™ Cybersecurity Admin Expert
- CVE-2022-45788A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of seSchneider Electric EcoStruxure Control Expert · Schneide… +5
- CVE-2022-48176Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to
- CVE-2023-24623Paranoidhttp before 0.3.0 allows SSRF because [::] is equivalent to the 127.0.0.1 address, but does not match the filter for private addressgithub.com/hakobe/paranoidhttp
Medium, low and unrated 54
- CVE-2023-23582 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior are vulnerable to a heap-based buffer overflow, which could allow an attacker to Snap One Wattbox WB-300-IP-3
- CVE-2023-22389 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported viaSnap One Wattbox WB-300-IP-3
- CVE-2023-22315 Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates Snap One Wattbox WB-300-IP-3
- CVE-2022-34888The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normaLenovo XClarity Controller
- CVE-2022-40137A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arLenovo BIOS
- CVE-2022-40136An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker wiLenovo BIOS
- CVE-2022-40135An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and Lenovo BIOS
- CVE-2022-40134An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access andLenovo BIOS
- CVE-2022-4667RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSSRSS Aggregator by Feedzy
- CVE-2022-4671PixCodes < 2.3.7 - Contributor+ Stored XSS in ShortcodePixCodes
- CVE-2022-4763Icon Widget < 1.3.0 - Contributor+ Stored XSS via ShortcodeIcon Widget
- CVE-2022-4470Widgets for Google Reviews < 9.8 - Contributor+ Stored XSSWidgets for Google Reviews
- CVE-2022-4831Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro < 1.8.1 - Contributor+ Stored XSS via ShortcodeCustom User Profile Fields for User Registration & Member F…
- CVE-2022-4651Justified Gallery < 1.7.1 - Contributor+ Stored XSS via ShortcodeJustified Gallery
- CVE-2023-0033PDF Viewer < 1.0.0 - Contributor+ Stored XSS via ShortcodePDF Viewer
- CVE-2022-4781Accordion Shortcodes <= 2.4.2 - Contributor+ Stored XSS via ShortcodeAccordion Shortcodes
- CVE-2022-4552FL3R FeelBox <= 8.1 - Settings Update via CSRF to Stored XSSFL3R FeelBox
- CVE-2022-4765Portfolio for Elementor, Image Gallery & Post Grid | PowerFolio < 2.3.1 - Contributor+ Stored XSS via ShortcodePortfolio for Elementor, Image Gallery & Post Grid | Power…
- CVE-2022-4749Posts List Designer by Category < 3.2 - Contributor+ Stored XSS via ShortcodePosts List Designer by Category
- CVE-2022-4837CPO Companion < 1.1.0 - Contributor+ Stored XSS via ShortcodeCPO Companion
- CVE-2023-0097Post Grid, Post Carousel, & List Category Posts < 2.4.19 - Contributor+ Stored XSSPost Grid, Post Carousel, & List Category Posts
- CVE-2022-4699MediaElement.js – HTML5 Video & Audio Player <= 4.2.8 - Contributor+ Stored XSS via ShortcodeMediaElement.js
- CVE-2023-0074WP Social Widget < 2.2.4 - Contributor+ Stored XSSWP Social Widget
- CVE-2022-4787Themify Shortcodes < 2.0.8 - Contributor+ Stored XSS via ShortcodeThemify Shortcodes
- CVE-2022-4553FL3R FeelBox <= 8.1 - Moods Reset via CSRFFL3R FeelBox
- CVE-2022-4792News & Blog Designer Pack < 3.3 - Contributor+ Stored XSS via ShortcodeNews & Blog Designer Pack
- CVE-2022-4835Social Sharing Toolkit <= 2.6 - Contributor+ Stored XSS via ShortcodeSocial Sharing Toolkit
- CVE-2022-4834CPT Bootstrap Carousel <= 1.12 - Contributor+ Stored XSS via ShortcodeCPT Bootstrap Carousel
- CVE-2022-4793Blog Designer – Post and Widget < 2.4.1 - Contributor+ Stored XSS via ShortcodeBlog Designer
- CVE-2022-4654Pricing Tables WordPress Plugin – Easy Pricing Tables < 3.2.3 - Contributor+ Stored XSS via ShortcodePricing Tables WordPress Plugin
- CVE-2022-4496miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO loginminiOrange WordPress SAML SSO Standard · miniOrange WordPre…
- CVE-2022-4649WP Extended Search < 2.1.2 - Contributor+ Stored XSS via ShortcodeWP Extended Search
- CVE-2022-4472Simple Sitemap < 3.5.8 - Contributor+ Stored XSSSimple Sitemap
- CVE-2022-4872WooCommerce Chained Products < 2.12.0 - Unauthenticated Arbitrary Options Update to 'no'Chained Products
- CVE-2023-0071WP Tabs < 2.1.17 - Contributor+ Stored XSSWP Tabs
- CVE-2022-4828Bold Timeline Lite < 1.1.5 - Contributor+ Stored XSS via ShortcodeBold Timeline Lite
- CVE-2022-4306Panda Pods Repeater Field < 1.5.4 - Reflected XSSPanda Pods Repeater Field
- CVE-2022-4776CC Child Pages < 1.43 - Contributor+ Stored XSS via ShortcodeCC Child Pages
- CVE-2023-0581PrivateContent <= 8.4.3 - Protection Mechanism BypassLCWeb PrivateContent
- CVE-2022-38451A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5.FreshTomato · Siretta QUARTZ-GOLD
- CVE-2022-0223A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker tSchneider Electric EcoStruxure Power Commission
- CVE-2022-22731A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allowSchneider Electric EcoStruxure Power Commission
- CVE-2022-22732A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) suppSchneider Electric EcoStruxure Power Commission
- CVE-2022-2988A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from Schneider Electric SoMachine HVAC · Schneider Electric EcoS…
- CVE-2022-32512A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code executiSchneider Electric CanBRASS
- CVE-2022-32517A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface uSchneider Electric Conext™ ComBox
- CVE-2022-45897On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored clearte
- CVE-2022-46087CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-48303GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump.
- CVE-2023-22322Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier.OMRON CX-Motion Pro
- CVE-2023-22324SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arbContec Co. CONPROSYS HMI System
- CVE-2023-22332Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 seriPgPool Global Development Group Pgpool-II
- CVE-2023-22333Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script.First Net Japan EasyMail
- CVE-2023-24622isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, leadsafeurl-python