CVEs published February 1, 2023
119 CVEs were published on February 1, 2023: 13 critical, 59 high.
- Published
- 119
- Critical
- 13
- High
- 59
- Medium
- 41
- Low
- 1
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- F5 BIG-IP
- 13
- Dell PowerScale OneFS
- 12
- Dell CPG BIOS
- 4
- Schneider Electric APC Easy UPS Online Monitoring Software…
- 4
- Apache Software Foundation Apache InLong · org.apache.inlon…
- 2
- Dell Command Update
- 2
- F5 APM Clients
- 2
- Joomla! Project Joomla! CMS
- 2
- Schneider Electric IGSS Data Server
- 2
- TRENDnet TEW-652BRP
- 2
Critical 13
- CVE-2023-22501An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate anoAtlassian Jira Service Management Data Center · Atlassian J…
- CVE-2023-24997Apache InLong: Jdbc Connection Security BypassApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2022-2329A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service andSchneider Electric IGSS Data Server
- CVE-2022-24324A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leadinSchneider Electric IGSS Data Server
- CVE-2022-42970A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a pSchneider Electric APC Easy UPS Online Monitoring Software…
- CVE-2022-42971A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uplSchneider Electric APC Easy UPS Online Monitoring Software…
- CVE-2022-47003A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request
- CVE-2022-47714Last Yard 22.09.8-1 does not enforce HSTS headers
- CVE-2022-47769An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious file
- CVE-2022-47770Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.
- CVE-2023-0587A file upload vulnerability in exists in Trend Micro Apex One server build 11110.Trend Micro Apex One
- CVE-2023-0606Cross-site Scripting (XSS) - Reflected in ampache/ampacheampache/ampache
- CVE-2023-23076OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.
High 59
- CVE-2023-23555BIG-IP Virtual Edition vulnerabilityF5 BIG-IP
- CVE-2023-23552BIG-IP Advanced WAF and ASM vulnerabilityF5 BIG-IP
- CVE-2023-22842BIG-IP SIP profile vulnerabilityF5 BIG-IP
- CVE-2023-22839BIG-IP DNS profile vulnerabilityF5 BIG-IP
- CVE-2023-22664BIG-IP HTTP/2 profile vulnerabilityF5 BIG-IP
- CVE-2023-22657F5OS vulnerabilityF5OS-A · F5OS-C
- CVE-2023-22422HTTP profile vulnerabilityF5 BIG-IP
- CVE-2023-22374iControl SOAP vulnerabilityF5 BIG-IP
- CVE-2023-22358BIG-IP Edge Client for Windows vulnerabilityF5 APM Clients
- CVE-2023-22341BIG-IP APM OAuth vulnerabilityF5 BIG-IP
- CVE-2023-22340BIG-IP SIP profile vulnerabilityF5 BIG-IP
- CVE-2023-22323BIG-IP SSL OCSP Authentication profile vulnerabilityF5 BIG-IP
- CVE-2023-22281BIG-IP AFM vulnerabilityF5 BIG-IP
- CVE-2023-0618TRENDnet TEW-652BRP Web Service cfg_op.ccp memory corruptionTRENDnet TEW-652BRP
- CVE-2023-0617TRENDNet TEW-811DRU httpd guestnetwork.asp buffer overflowTRENDNet TEW-811DRU
- CVE-2023-0613TRENDnet TEW-811DRU httpd security.asp memory corruptionTRENDnet TEW-811DRU
- CVE-2023-0612TRENDnet TEW-811DRU httpd basic.asp buffer overflowTRENDnet TEW-811DRU
- CVE-2023-0611TRENDnet TEW-652BRP Web Management Interface get_set.ccp command injectionTRENDnet TEW-652BRP
- CVE-2023-22575Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog.Dell PowerScale OneFS
- CVE-2023-22573Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool.Dell PowerScale OneFS
- CVE-2023-22574 Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI mDell PowerScale OneFS
- CVE-2023-22572 Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api.Dell PowerScale OneFS
- CVE-2023-23692 Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability.Dell Data Domain
- CVE-2023-24977Apache InLong: Jdbc Connection causes arbitrary file reading in InLongApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2022-46756 Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability.Dell VxRail HCI
- CVE-2022-34398 Dell BIOS contains a Time-of-check Time-of-use vulnerability.Dell CPG BIOS
- CVE-2022-34396 Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability.Dell OpenManage Server Administrator
- CVE-2022-34403 Dell BIOS contains a Stack based buffer overflow vulnerability.Dell CPG BIOS
- CVE-2022-45100 Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability.Dell PowerScale OneFS
- CVE-2022-45099 Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password.Dell PowerScale OneFS
- CVE-2022-25906All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes beis-http2
- CVE-2022-25916Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scamt7688-wiscan
- CVE-2022-45101 Dell PowerScale OneFS 9.0.0.x - 9.4.0.x, contains an Improper Handling of Insufficient Privileges vulnerability in NFS.Dell PowerScale OneFS
- CVE-2022-34459 Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature iDell Command Update
- CVE-2022-34400 Dell BIOS contains a heap buffer overflow vulnerability.Dell CPG BIOS
- CVE-2022-34443 Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint.Dell Rugged Control Center
- CVE-2023-23630Cross-site (XSS) vulnerability with Express API in Etaeta-dev eta · eta
- CVE-2021-22786A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the contSchneider Electric Modicon M340 CPU · Schneider Electric… +3
- CVE-2022-30904In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no c
- CVE-2022-31363Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow.
- CVE-2022-31364Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow.
- CVE-2022-4062A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gSchneider Electric EcoStruxure Power Commission
- CVE-2022-4254sssd: libsss_certmap fails to sanitise certificate data used in LDAP filtersSSSD
- CVE-2022-42972A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a locSchneider Electric APC Easy UPS Online Monitoring Software…
- CVE-2022-42973A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to thSchneider Electric APC Easy UPS Online Monitoring Software…
- CVE-2022-45782An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1.
- CVE-2022-47717Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
- CVE-2022-47768Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.
- CVE-2022-48093Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
- CVE-2023-0454OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server.OrangeScrum
- CVE-2023-0524As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally.Tenable.io, Tenable.sc, Nessus
- CVE-2023-0607Cross-site Scripting (XSS) - Stored in projectsend/projectsendprojectsend/projectsend
- CVE-2023-20856VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability.VMware vRealize Operations
- CVE-2023-23131Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings.
- CVE-2023-23132Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure.
- CVE-2023-23135An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file.
- CVE-2023-23846Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headersOpen5GS
- CVE-2023-23969In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avodjango
- CVE-2023-24610NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature.
Medium, low and unrated 47
- CVE-2023-0599Rapid7 Metasploit Pro Stored XSSRapid7 Metasploit Pro
- CVE-2022-3913Rapid7 Nexpose Certificate Validation IssueRapid7 Nexpose · Rapid7 InsightVM
- CVE-2023-23751[20230102] - Core - Missing ACL checks for com_actionlogsJoomla! Project Joomla! CMS
- CVE-2023-23750[20230101] - Core - CSRF within post-installation messagesJoomla! Project Joomla! CMS
- CVE-2022-3083All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity.Landis+Gyr E850
- CVE-2023-0619Kraken.io Image Optimizer <= 2.6.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Updatekarim79 Kraken.io Image Optimizer
- CVE-2023-23469IBM Cloud Pak for Business Automation information disclosureIBM Cloud Pak for Business Automation
- CVE-2023-22418BIG-IP APM virtual server vulnerabilityF5 BIG-IP
- CVE-2023-22326iControl REST and tmsh vulnerabilityF5 BIG-IP · F5 BIG-IQ Centralized Management
- CVE-2023-22302BIG-IP HTTP profile vulnerabilityF5 BIG-IP
- CVE-2023-22283BIG-IP Edge Client for Windows vulnerabilityF5 APM Clients
- CVE-2022-47983IBM InfoSphere Information Server cross-site scriptingIBM InfoSphere Information Server
- CVE-2022-43922IBM App Connect Enterprise Certified Container information disclosureIBM App Connect Enterprise Certified Container
- CVE-2023-0400 The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0.Trellix Data Loss Prevention
- CVE-2022-46679 Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability.Dell PowerScale OneFS
- CVE-2022-32482 Dell BIOS contains an improper input validation vulnerability.Dell CPG BIOS
- CVE-2022-45102 Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability.Dell Data Protection Central
- CVE-2022-45098 Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 component.Dell PowerScale OneFS
- CVE-2022-45096 Dell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue.Dell PowerScale OneFS
- CVE-2022-45097 Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability.Dell PowerScale OneFS
- CVE-2022-45095 Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability.Dell PowerScale OneFS
- CVE-2022-34458 Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a Exposure of Sensitive System Information to an UnaDell Command Update
- CVE-2023-23928reason-jose ignores signature checksulrikstrid reason-jose
- CVE-2022-31902Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
- CVE-2022-37033In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF acces
- CVE-2022-37034In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file
- CVE-2022-4206A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the AuthorGitLab DAST API scanner
- CVE-2022-45783An issue was discovered in dotCMS core 4.x through 22.10.2.
- CVE-2022-46934kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewCon
- CVE-2022-47002A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web
- CVE-2022-47715In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.
- CVE-2022-47872A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a
- CVE-2022-48094lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
- CVE-2023-0608Cross-site Scripting (XSS) - DOM in microweber/microwebermicroweber/microweber
- CVE-2023-0609Improper Authorization in wallabag/wallabagwallabag/wallabag
- CVE-2023-0610Improper Authorization in wallabag/wallabagwallabag/wallabag
- CVE-2023-23073Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component.
- CVE-2023-23074Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.
- CVE-2023-23075Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation.
- CVE-2023-23077Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment.
- CVE-2023-23078Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the
- CVE-2023-23126Connectwise Automate 2022.11 is vulnerable to Clickjacking.
- CVE-2023-23127In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS.
- CVE-2023-23128Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS).
- CVE-2023-23130Connectwise Automate 2022.11 is vulnerable to Cleartext authentication.
- CVE-2023-23136lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php.
- CVE-2023-25012The Linux kernel through 6.1.9 has a Use-After-Free in bigben_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED