CVEs published January 31, 2023
50 CVEs were published on January 31, 2023: 17 critical, 16 high.
- Published
- 50
- Critical
- 17
- High
- 16
- Medium
- 15
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- ChangingTec MegaServiSignAdapter
- 3
- Apache Software Foundation Apache Linkis · org.apache.linki…
- 2
- Apache Software Foundation Apache Portable Runtime
- 2
- cn.hutool:hutool-all
- 2
- Hitachi Storage Plug-in for VMware vCenter
- 2
- SailPoint IdentityIQ
- 2
- Schneider Electric EcoStruxure Geo SCADA Expert 2019 -
- 2
- AMI MegaRAC SPx-12 · AMI MegaRAC SPx-13
- 1
- Apache Software Foundation Apache IoTDB Workbench · apache-…
- 1
- Apache Software Foundation Apache Portable Runtime Utility
- 1
Critical 17
- CVE-2023-23924URI validation failure on SVG parsing in Dompdfdompdf · dompdf/dompdf
- CVE-2022-28331Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv functionApache Software Foundation Apache Portable Runtime
- CVE-2022-24963Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functionsApache Software Foundation Apache Portable Runtime
- CVE-2022-39060ChangingTec MegaServiSignAdapter - Improper Input ValidationChangingTec MegaServiSignAdapter
- CVE-2022-45172An issue was discovered in LIVEBOX Collaboration vDesk before v018.
- CVE-2022-45297EQ v1.5.31 to v2.2.0 was discovered to contain a SQL injection vulnerability via the UserPwd parameter.
- CVE-2022-47035Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConf
- CVE-2022-47697COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeov
- CVE-2022-47699COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incorrect Access Control.
- CVE-2022-47780SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.
- CVE-2022-47854i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.
- CVE-2022-47873Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).
- CVE-2023-22610 A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messaSchneider Electric EcoStruxure Geo SCADA Expert 2019 -
- CVE-2023-22900Thinking Software Technology Co., Ltd. Efence - SQL InjectionThinking Software Technology Co. Efence
- CVE-2023-24162Deserialization vulnerability in Dromara Hutool v5.8.11 allows attacker to execute arbitrary code via the XmlUtil.readObjectFromXml parametecn.hutool:hutool-all
- CVE-2023-24163SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.cn.hutool:hutool-all
- CVE-2023-24241Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /admin/loginpost.php.
High 16
- CVE-2023-0341Stack Buffer Overflow in editorconfig-core-cEditorConfig C Core
- CVE-2022-44645Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerabilityApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2023-24829Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchApache Software Foundation Apache IoTDB Workbench · apache-…
- CVE-2022-21129Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.expornemo-appium
- CVE-2022-4441Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenterHitachi Storage Plug-in for VMware vCenter
- CVE-2020-20402Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation.
- CVE-2022-30421Improper Authentication vulnerability in Toshiba Storage Security Software V1.2.0.7413 is that allows for sensitive information to be obtain
- CVE-2022-32984BTCPay Server 1.3.0 through 1.5.3 allows a remote attacker to obtain sensitive information when a public Point of Sale app is exposed.
- CVE-2022-39059ChangingTec MegaServiSignAdapter - Path TraversalChangingTec MegaServiSignAdapter
- CVE-2022-45494Buffer overflow vulnerability in function json_parse_object in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (Novemb
- CVE-2022-45789A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the cSchneider Electric EcoStruxure Control Expert · Schneide… +2
- CVE-2022-46835SailPoint IdentityIQ JavaServer File Path Traversal VulnerabilitySailPoint IdentityIQ
- CVE-2022-47700COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Acce
- CVE-2022-48161Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php.
- CVE-2023-22611A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specSchneider Electric EcoStruxure Geo SCADA Expert 2019 -
- CVE-2023-24956Forget Heart Message Box v1.1 was discovered to contain a SQL injection vulnerability via the name parameter at /cha.php.
Medium, low and unrated 17
- CVE-2016-15023SiteFusion Application Server Extension getextension.php path traversalSiteFusion Application Server
- CVE-2022-25147Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functionsApache Software Foundation Apache Portable Runtime Utility
- CVE-2022-44644Apache Linkis (incubating): The DatasourceManager module has a Local File Read VulnerabilityApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2023-0593Path traversal in yaffshivdevttys0 yaffshiv
- CVE-2023-0592Path traversal in jeffersonsviehb jefferson
- CVE-2023-0591Path Traversal in ubi_readerjrspruitt ubi_reader · ubi-reader
- CVE-2022-25979Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Edijsuites · org.webjars.npm:jsuites
- CVE-2022-25881This affects versions of the package http-cache-semantics before 4.1.1.http-cache-semantics · org.webjars.npm:http-cache-semantics
- CVE-2022-4041Privilege Escalation Vulnerability in Hitachi Storage Plug-in for VMware vCenterHitachi Storage Plug-in for VMware vCenter
- CVE-2022-40258Weak password hashes for Redfish & APIAMI MegaRAC SPx-12 · AMI MegaRAC SPx-13
- CVE-2022-39061ChangingTec MegaServiSignAdapter - Out-of-bounds ReadChangingTec MegaServiSignAdapter
- CVE-2022-44897A cross-site scripting (XSS) vulnerability in ApolloTheme AP PageBuilder component through 2.4.4 allows attackers to execute arbitrary web s
- CVE-2022-45435SailPoint IdentityIQ Access Control BypassSailPoint IdentityIQ
- CVE-2022-45598Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.joplin
- CVE-2022-47698COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS
- CVE-2022-47701COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS
- CVE-2022-4898In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link.Octopus Deploy Octopus Server