# CVEs published 2023-01-30

102 CVEs were published on January 30, 2023: 16 critical, 32 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-23582](https://cve.now/CVE-2023-23582.md): Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior are vulnerable to a heap-based buffer overflow, which could allow an attacker to (CVSS 5.3, Snap One Wattbox WB-300-IP-3)
- [CVE-2023-22389](https://cve.now/CVE-2023-22389.md): Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior store passwords in a plaintext file when the device configuration is exported via (CVSS 5.7, Snap One Wattbox WB-300-IP-3)
- [CVE-2023-22315](https://cve.now/CVE-2023-22315.md): Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior use a proprietary local area network (LAN) protocol that does not verify updates (CVSS 6.7, Snap One Wattbox WB-300-IP-3)
- [CVE-2023-24020](https://cve.now/CVE-2023-24020.md): Snap One Wattbox WB-300-IP-3 versions WB10.9a17 and prior could bypass the brute force protection, allowing multiple attempts to force a lo (CVSS 7.5, Snap One Wattbox WB-300-IP-3)
- [CVE-2022-34885](https://cve.now/CVE-2022-34885.md): An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arb (CVSS 7.2, Motorola MR2600 Router)
- [CVE-2022-34888](https://cve.now/CVE-2022-34888.md): The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not norma (CVSS 2.7, Lenovo XClarity Controller)
- [CVE-2021-3439](https://cve.now/CVE-2021-3439.md): HP has identified a potential vulnerability in BIOS firmware of some Workstation products. (CVSS 7.8, HP PC BIOS)
- [CVE-2022-23455](https://cve.now/CVE-2022-23455.md): Potential security vulnerabilities have been identified in HP Support Assistant. (CVSS 7.8, HP Support Assistant)
- [CVE-2022-23454](https://cve.now/CVE-2022-23454.md): Potential security vulnerabilities have been identified in HP Support Assistant. (CVSS 7.8, HP Support Assistant)
- [CVE-2022-23453](https://cve.now/CVE-2022-23453.md): Potential security vulnerabilities have been identified in HP Support Assistant. (CVSS 7.8, HP Support Assistant)
- [CVE-2022-34884](https://cve.now/CVE-2022-34884.md): A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subs (CVSS 7.2, Lenovo XClarity Controller)
- [CVE-2022-40137](https://cve.now/CVE-2022-40137.md): A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute ar (CVSS 6.7, Lenovo BIOS)
- [CVE-2022-27537](https://cve.now/CVE-2022-27537.md): Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, esc (CVSS 7.8, HP PC BIOS)
- [CVE-2022-40136](https://cve.now/CVE-2022-40136.md): An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker wi (CVSS 4.4, Lenovo BIOS)
- [CVE-2022-40135](https://cve.now/CVE-2022-40135.md): An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and (CVSS 4.4, Lenovo BIOS)
- [CVE-2022-40134](https://cve.now/CVE-2022-40134.md): An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and (CVSS 4.4, Lenovo BIOS)
- [CVE-2021-3809](https://cve.now/CVE-2021-3809.md): Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary (CVSS 7.8, HP PC BIOS)
- [CVE-2021-3808](https://cve.now/CVE-2021-3808.md): Potential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary (CVSS 7.8, HP PC BIOS)
- [CVE-2022-27538](https://cve.now/CVE-2022-27538.md): A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow a (CVSS 7.0, HP PC BIOS)
- [CVE-2022-4667](https://cve.now/CVE-2022-4667.md): RSS Aggregator by Feedzy \< 4.1.1 - Contributor+ Stored XSS (CVSS 5.4, RSS Aggregator by Feedzy)
- [CVE-2022-4671](https://cve.now/CVE-2022-4671.md): PixCodes \< 2.3.7 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, PixCodes)
- [CVE-2022-4763](https://cve.now/CVE-2022-4763.md): Icon Widget \< 1.3.0 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Icon Widget)
- [CVE-2022-4470](https://cve.now/CVE-2022-4470.md): Widgets for Google Reviews \< 9.8 - Contributor+ Stored XSS (CVSS 6.4, Widgets for Google Reviews)
- [CVE-2022-4831](https://cve.now/CVE-2022-4831.md): Custom User Profile Fields for User Registration & Member Frontend Profiles with Paid Memberships Pro \< 1.8.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Custom User Profile Fields for User Registration & Member F…)
- [CVE-2022-4651](https://cve.now/CVE-2022-4651.md): Justified Gallery \< 1.7.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Justified Gallery)
- [CVE-2023-0033](https://cve.now/CVE-2023-0033.md): PDF Viewer \< 1.0.0 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, PDF Viewer)
- [CVE-2022-4781](https://cve.now/CVE-2022-4781.md): Accordion Shortcodes \<= 2.4.2 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Accordion Shortcodes)
- [CVE-2022-4552](https://cve.now/CVE-2022-4552.md): FL3R FeelBox \<= 8.1 - Settings Update via CSRF to Stored XSS (CVSS 6.1, FL3R FeelBox)
- [CVE-2022-4765](https://cve.now/CVE-2022-4765.md): Portfolio for Elementor, Image Gallery & Post Grid | PowerFolio \< 2.3.1 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Portfolio for Elementor, Image Gallery & Post Grid | Power…)
- [CVE-2022-4749](https://cve.now/CVE-2022-4749.md): Posts List Designer by Category \< 3.2 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Posts List Designer by Category)
- [CVE-2022-4837](https://cve.now/CVE-2022-4837.md): CPO Companion \< 1.1.0 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, CPO Companion)
- [CVE-2023-0097](https://cve.now/CVE-2023-0097.md): Post Grid, Post Carousel, & List Category Posts \< 2.4.19 - Contributor+ Stored XSS (CVSS 5.4, Post Grid, Post Carousel, & List Category Posts)
- [CVE-2022-4699](https://cve.now/CVE-2022-4699.md): MediaElement.js – HTML5 Video & Audio Player \<= 4.2.8 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, MediaElement.js)
- [CVE-2023-0074](https://cve.now/CVE-2023-0074.md): WP Social Widget \< 2.2.4 - Contributor+ Stored XSS (CVSS 5.4, WP Social Widget)
- [CVE-2022-4787](https://cve.now/CVE-2022-4787.md): Themify Shortcodes \< 2.0.8 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Themify Shortcodes)
- [CVE-2022-4553](https://cve.now/CVE-2022-4553.md): FL3R FeelBox \<= 8.1 - Moods Reset via CSRF (CVSS 4.3, FL3R FeelBox)
- [CVE-2022-4680](https://cve.now/CVE-2022-4680.md): Revive Old Posts – Social Media Auto Post and Scheduling Plugin \< 9.0.11 - PHP Object Injection (CVSS 7.2, Revive Old Posts)
- [CVE-2022-4395](https://cve.now/CVE-2022-4395.md): Membership For WooCommerce \< 2.1.7 - Unauthenticated Arbitrary File Upload (CVSS 9.8, Membership For WooCommerce)
- [CVE-2022-4792](https://cve.now/CVE-2022-4792.md): News & Blog Designer Pack \< 3.3 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, News & Blog Designer Pack)
- [CVE-2022-4835](https://cve.now/CVE-2022-4835.md): Social Sharing Toolkit \<= 2.6 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Social Sharing Toolkit)
- [CVE-2022-4834](https://cve.now/CVE-2022-4834.md): CPT Bootstrap Carousel \<= 1.12 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, CPT Bootstrap Carousel)
- [CVE-2022-4793](https://cve.now/CVE-2022-4793.md): Blog Designer – Post and Widget \< 2.4.1 - Contributor+ Stored XSS via Shortcode (CVSS 6.8, Blog Designer)
- [CVE-2022-4654](https://cve.now/CVE-2022-4654.md): Pricing Tables WordPress Plugin – Easy Pricing Tables \< 3.2.3 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Pricing Tables WordPress Plugin)
- [CVE-2022-4496](https://cve.now/CVE-2022-4496.md): miniOrange WordPress SAML SSO multiple versions - Open Redirect in SSO login (CVSS 6.1, miniOrange WordPress SAML SSO Standard · miniOrange WordPre…)
- [CVE-2022-4649](https://cve.now/CVE-2022-4649.md): WP Extended Search \< 2.1.2 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, WP Extended Search)
- [CVE-2022-4472](https://cve.now/CVE-2022-4472.md): Simple Sitemap \< 3.5.8 - Contributor+ Stored XSS (CVSS 5.4, Simple Sitemap)
- [CVE-2022-4872](https://cve.now/CVE-2022-4872.md): WooCommerce Chained Products \< 2.12.0 - Unauthenticated Arbitrary Options Update to 'no' (CVSS 4.3, Chained Products)
- [CVE-2023-0071](https://cve.now/CVE-2023-0071.md): WP Tabs \< 2.1.17 - Contributor+ Stored XSS (CVSS 5.4, WP Tabs)
- [CVE-2022-4794](https://cve.now/CVE-2022-4794.md): AAWP \< 3.12.3 - Unsafe URL Handling (CVSS 7.5, AAWP)
- [CVE-2022-4828](https://cve.now/CVE-2022-4828.md): Bold Timeline Lite \< 1.1.5 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Bold Timeline Lite)
- [CVE-2022-4306](https://cve.now/CVE-2022-4306.md): Panda Pods Repeater Field \< 1.5.4 - Reflected XSS (CVSS 5.4, Panda Pods Repeater Field)
- [CVE-2022-4776](https://cve.now/CVE-2022-4776.md): CC Child Pages \< 1.43 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, CC Child Pages)
- [CVE-2022-3990](https://cve.now/CVE-2022-3990.md): HPSFViewer might allow Escalation of Privilege. (CVSS 7.8, HPSFViewer)
- [CVE-2023-24830](https://cve.now/CVE-2023-24830.md): Apache IoTDB Workbench: apache/iotdb-web-workbench: create a user without authorization (CVSS 7.5, Apache Software Foundation Apache IoTDB Workbench · apache-…)
- [CVE-2022-26872](https://cve.now/CVE-2022-26872.md): Password reset interception via API (CVSS 8.3, AMI MegaRAC SPx-12 · AMI MegaRAC SPx-13)
- [CVE-2023-0581](https://cve.now/CVE-2023-0581.md): PrivateContent \<= 8.4.3 - Protection Mechanism Bypass (CVSS 5.3, LCWeb PrivateContent)
- [CVE-2023-0240](https://cve.now/CVE-2023-0240.md): Use after free in io\_uring in the Linux Kernel (CVSS 7.8, Linux Kernel)
- [CVE-2023-0266](https://cve.now/CVE-2023-0266.md): Use after free in SNDRV\_CTL\_IOCTL\_ELEM in Linux Kernel (CVSS 7.9, KEV, Linux Kernel)
- [CVE-2022-42484](https://cve.now/CVE-2022-42484.md): An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. (CVSS 9.1, FreshTomato · Siretta QUARTZ-GOLD)
- [CVE-2022-38451](https://cve.now/CVE-2022-38451.md): A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. (CVSS 6.8, FreshTomato · Siretta QUARTZ-GOLD)
- [CVE-2022-25936](https://cve.now/CVE-2022-25936.md): Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. (CVSS 7.5, servst)
- [CVE-2022-25967](https://cve.now/CVE-2022-25967.md): Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variable (CVSS 8.1, eta)
- [CVE-2022-27596](https://cve.now/CVE-2022-27596.md): Vulnerability in QTS (CVSS 9.8, QNAP Systems QuTS hero · QNAP Systems QTS)
- [CVE-2022-0223](https://cve.now/CVE-2022-0223.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker t (CVSS 6.5, Schneider Electric EcoStruxure Power Commission)
- [CVE-2022-22731](https://cve.now/CVE-2022-22731.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow (CVSS 6.5, Schneider Electric EcoStruxure Power Commission)
- [CVE-2022-22732](https://cve.now/CVE-2022-22732.md): A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supp (CVSS 3.9, Schneider Electric EcoStruxure Power Commission)
- [CVE-2022-23334](https://cve.now/CVE-2022-23334.md): The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers (CVSS 9.8)
- [CVE-2022-2988](https://cve.now/CVE-2022-2988.md): A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from (CVSS 4.3, Schneider Electric SoMachine HVAC · Schneider Electric EcoS…)
- [CVE-2022-32512](https://cve.now/CVE-2022-32512.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code executi (CVSS 5.3, Schneider Electric CanBRASS)
- [CVE-2022-32513](https://cve.now/CVE-2022-32513.md): A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brut (CVSS 9.8, Schneider Electric C-Bus Network Automation Controller,… +4)
- [CVE-2022-32514](https://cve.now/CVE-2022-32514.md): A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web p (CVSS 9.8, Schneider Electric C-Bus Network Automation Controller,… +4)
- [CVE-2022-32515](https://cve.now/CVE-2022-32515.md): A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over (CVSS 8.6, Schneider Electric Conext™ ComBox)
- [CVE-2022-32516](https://cve.now/CVE-2022-32516.md): A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop (CVSS 7.5, Schneider Electric Conext™ ComBox)
- [CVE-2022-32517](https://cve.now/CVE-2022-32517.md): A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface u (CVSS 6.5, Schneider Electric Conext™ ComBox)
- [CVE-2022-32518](https://cve.now/CVE-2022-32518.md): A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed o (CVSS 8.0, Schneider Electric Data Center Expert)
- [CVE-2022-32519](https://cve.now/CVE-2022-32519.md): A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when perfor (CVSS 8.0, Schneider Electric Data Center Expert)
- [CVE-2022-32520](https://cve.now/CVE-2022-32520.md): A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed o (CVSS 8.0, Schneider Electric Data Center Expert)
- [CVE-2022-32521](https://cve.now/CVE-2022-32521.md): A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely (CVSS 7.1, Schneider Electric Data Center Expert)
- [CVE-2022-32522](https://cve.now/CVE-2022-32522.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadi (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-32523](https://cve.now/CVE-2022-32523.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadi (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-32524](https://cve.now/CVE-2022-32524.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadi (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-32525](https://cve.now/CVE-2022-32525.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadi (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-32526](https://cve.now/CVE-2022-32526.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadi (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-32527](https://cve.now/CVE-2022-32527.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadi (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-32528](https://cve.now/CVE-2022-32528.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files (CVSS 8.6, Schneider Electric IGSS Data Server)
- [CVE-2022-32529](https://cve.now/CVE-2022-32529.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leadi (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-32747](https://cve.now/CVE-2022-32747.md): A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitat (CVSS 8.0, Schneider Electric EcoStruxure™ Cybersecurity Admin Expert)
- [CVE-2022-32748](https://cve.now/CVE-2022-32748.md): A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using (CVSS 7.9, Schneider Electric EcoStruxure™ Cybersecurity Admin Expert)
- [CVE-2022-45788](https://cve.now/CVE-2022-45788.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of se (CVSS 7.5, Schneider Electric EcoStruxure Control Expert · Schneide… +5)
- [CVE-2022-45897](https://cve.now/CVE-2022-45897.md): On Xerox WorkCentre 3550 25.003.03.000 devices, an authenticated attacker can view the SMB server settings and can obtain the stored clearte (CVSS 6.5)
- [CVE-2022-46087](https://cve.now/CVE-2022-46087.md): CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2022-48006](https://cve.now/CVE-2022-48006.md): An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. (CVSS 9.8)
- [CVE-2022-48175](https://cve.now/CVE-2022-48175.md): Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dash (CVSS 9.8)
- [CVE-2022-48176](https://cve.now/CVE-2022-48176.md): Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to (CVSS 7.8)
- [CVE-2022-48303](https://cve.now/CVE-2022-48303.md): GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. (CVSS 5.5)
- [CVE-2023-22322](https://cve.now/CVE-2023-22322.md): Improper restriction of XML external entity reference (XXE) vulnerability exists in OMRON CX-Motion Pro 1.4.6.013 and earlier. (CVSS 5.5, OMRON CX-Motion Pro)
- [CVE-2023-22324](https://cve.now/CVE-2023-22324.md): SQL injection vulnerability in the CONPROSYS HMI System (CHS) Ver.3.5.0 and earlier allows a remote authenticated attacker to execute an arb (CVSS 6.5, Contec Co. CONPROSYS HMI System)
- [CVE-2023-22332](https://cve.now/CVE-2023-22332.md): Information disclosure vulnerability exists in Pgpool-II 4.4.0 to 4.4.1 (4.4 series), 4.3.0 to 4.3.4 (4.3 series), 4.2.0 to 4.2.11 (4.2 seri (CVSS 6.5, PgPool Global Development Group Pgpool-II)
- [CVE-2023-22333](https://cve.now/CVE-2023-22333.md): Cross-site scripting vulnerability in EasyMail 2.00.130 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. (CVSS 6.1, First Net Japan EasyMail)
- [CVE-2023-24612](https://cve.now/CVE-2023-24612.md): The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option. (CVSS 9.8)
- [CVE-2023-24622](https://cve.now/CVE-2023-24622.md): isInList in the safeurl-python package before 1.2 for Python has an insufficiently restrictive regular expression for external domains, lead (CVSS 5.3, safeurl-python)
- [CVE-2023-24623](https://cve.now/CVE-2023-24623.md): Paranoidhttp before 0.3.0 allows SSRF because \[::\] is equivalent to the 127.0.0.1 address, but does not match the filter for private address (CVSS 7.5, github.com/hakobe/paranoidhttp)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.