# CVEs published 2023-02-01

119 CVEs were published on February 1, 2023: 13 critical, 59 high. Days are UTC.

- [CVE-2023-0599](https://cve.now/CVE-2023-0599.md): Rapid7 Metasploit Pro Stored XSS (CVSS 6.1, Rapid7 Metasploit Pro)
- [CVE-2022-3913](https://cve.now/CVE-2022-3913.md): Rapid7 Nexpose Certificate Validation Issue (CVSS 5.3, Rapid7 Nexpose · Rapid7 InsightVM)
- [CVE-2023-23751](https://cve.now/CVE-2023-23751.md): \[20230102\] - Core - Missing ACL checks for com\_actionlogs (CVSS 4.3, Joomla! Project Joomla! CMS)
- [CVE-2023-23750](https://cve.now/CVE-2023-23750.md): \[20230101\] - Core - CSRF within post-installation messages (CVSS 6.3, Joomla! Project Joomla! CMS)
- [CVE-2022-3083](https://cve.now/CVE-2022-3083.md): All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. (CVSS 3.9, Landis+Gyr E850)
- [CVE-2023-0619](https://cve.now/CVE-2023-0619.md): Kraken.io Image Optimizer \<= 2.6.8 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update (CVSS 6.5, karim79 Kraken.io Image Optimizer)
- [CVE-2023-23469](https://cve.now/CVE-2023-23469.md): IBM Cloud Pak for Business Automation information disclosure (CVSS 4.0, IBM Cloud Pak for Business Automation)
- [CVE-2023-22501](https://cve.now/CVE-2023-22501.md): An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate ano (CVSS 9.4, Atlassian Jira Service Management Data Center · Atlassian J…)
- [CVE-2023-23555](https://cve.now/CVE-2023-23555.md): BIG-IP Virtual Edition vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-23552](https://cve.now/CVE-2023-23552.md): BIG-IP Advanced WAF and ASM vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22842](https://cve.now/CVE-2023-22842.md): BIG-IP SIP profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22839](https://cve.now/CVE-2023-22839.md): BIG-IP DNS profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22664](https://cve.now/CVE-2023-22664.md): BIG-IP HTTP/2 profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22657](https://cve.now/CVE-2023-22657.md): F5OS vulnerability (CVSS 7.0, F5OS-A · F5OS-C)
- [CVE-2023-22422](https://cve.now/CVE-2023-22422.md): HTTP profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22418](https://cve.now/CVE-2023-22418.md): BIG-IP APM virtual server vulnerability (CVSS 6.1, F5 BIG-IP)
- [CVE-2023-22374](https://cve.now/CVE-2023-22374.md): iControl SOAP vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22358](https://cve.now/CVE-2023-22358.md): BIG-IP Edge Client for Windows vulnerability (CVSS 7.8, F5 APM Clients)
- [CVE-2023-22341](https://cve.now/CVE-2023-22341.md): BIG-IP APM OAuth vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22340](https://cve.now/CVE-2023-22340.md): BIG-IP SIP profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22326](https://cve.now/CVE-2023-22326.md): iControl REST and tmsh vulnerability (CVSS 4.9, F5 BIG-IP · F5 BIG-IQ Centralized Management)
- [CVE-2023-22323](https://cve.now/CVE-2023-22323.md): BIG-IP SSL OCSP Authentication profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-22302](https://cve.now/CVE-2023-22302.md): BIG-IP HTTP profile vulnerability (CVSS 5.9, F5 BIG-IP)
- [CVE-2023-22283](https://cve.now/CVE-2023-22283.md): BIG-IP Edge Client for Windows vulnerability (CVSS 6.5, F5 APM Clients)
- [CVE-2023-22281](https://cve.now/CVE-2023-22281.md): BIG-IP AFM vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2022-47983](https://cve.now/CVE-2022-47983.md): IBM InfoSphere Information Server cross-site scripting (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2022-43922](https://cve.now/CVE-2022-43922.md): IBM App Connect Enterprise Certified Container information disclosure (CVSS 5.3, IBM App Connect Enterprise Certified Container)
- [CVE-2023-0618](https://cve.now/CVE-2023-0618.md): TRENDnet TEW-652BRP Web Service cfg\_op.ccp memory corruption (CVSS 7.5, TRENDnet TEW-652BRP)
- [CVE-2023-0617](https://cve.now/CVE-2023-0617.md): TRENDNet TEW-811DRU httpd guestnetwork.asp buffer overflow (CVSS 7.5, TRENDNet TEW-811DRU)
- [CVE-2023-0400](https://cve.now/CVE-2023-0400.md): The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. (CVSS 5.9, Trellix Data Loss Prevention)
- [CVE-2023-24997](https://cve.now/CVE-2023-24997.md): Apache InLong: Jdbc Connection Security Bypass (CVSS 9.8, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2023-0613](https://cve.now/CVE-2023-0613.md): TRENDnet TEW-811DRU httpd security.asp memory corruption (CVSS 7.5, TRENDnet TEW-811DRU)
- [CVE-2023-0612](https://cve.now/CVE-2023-0612.md): TRENDnet TEW-811DRU httpd basic.asp buffer overflow (CVSS 7.5, TRENDnet TEW-811DRU)
- [CVE-2023-0611](https://cve.now/CVE-2023-0611.md): TRENDnet TEW-652BRP Web Management Interface get\_set.ccp command injection (CVSS 8.8, TRENDnet TEW-652BRP)
- [CVE-2023-22575](https://cve.now/CVE-2023-22575.md): Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in celog. (CVSS 8.7, Dell PowerScale OneFS)
- [CVE-2023-22573](https://cve.now/CVE-2023-22573.md): Dell PowerScale OneFS 9.0.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in cloudpool. (CVSS 7.9, Dell PowerScale OneFS)
- [CVE-2023-22574](https://cve.now/CVE-2023-22574.md): Dell PowerScale OneFS 9.0.0.x - 9.4.0.x contain an insertion of sensitive information into log file vulnerability in platform API of IPMI m (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2023-22572](https://cve.now/CVE-2023-22572.md): Dell PowerScale OneFS 9.1.0.x-9.4.0.x contain an insertion of sensitive information into log file vulnerability in change password api. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2023-23692](https://cve.now/CVE-2023-23692.md): Dell EMC prior to version DDOS 7.9 contain(s) an OS command injection Vulnerability. (CVSS 8.8, Dell Data Domain)
- [CVE-2023-24977](https://cve.now/CVE-2023-24977.md): Apache InLong: Jdbc Connection causes arbitrary file reading in InLong (CVSS 7.5, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2022-46756](https://cve.now/CVE-2022-46756.md): Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. (CVSS 8.2, Dell VxRail HCI)
- [CVE-2022-46679](https://cve.now/CVE-2022-46679.md): Dell PowerScale OneFS 8.2.x, 9.0.0.x - 9.4.0.x, contain an insufficient resource pool vulnerability. (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2022-34398](https://cve.now/CVE-2022-34398.md): Dell BIOS contains a Time-of-check Time-of-use vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-34396](https://cve.now/CVE-2022-34396.md): Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. (CVSS 7.0, Dell OpenManage Server Administrator)
- [CVE-2022-34403](https://cve.now/CVE-2022-34403.md): Dell BIOS contains a Stack based buffer overflow vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-32482](https://cve.now/CVE-2022-32482.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 5.6, Dell CPG BIOS)
- [CVE-2022-45102](https://cve.now/CVE-2022-45102.md): Dell EMC Data Protection Central, versions 19.1 through 19.7, contains a Host Header Injection vulnerability. (CVSS 5.4, Dell Data Protection Central)
- [CVE-2022-45100](https://cve.now/CVE-2022-45100.md): Dell PowerScale OneFS, versions 8.2.x-9.3.x, contains an Improper Certificate Validation vulnerability. (CVSS 8.1, Dell PowerScale OneFS)
- [CVE-2022-45099](https://cve.now/CVE-2022-45099.md): Dell PowerScale OneFS, versions 8.2.x-9.4.x, contain a weak encoding for a NDMP password. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2022-45098](https://cve.now/CVE-2022-45098.md): Dell PowerScale OneFS, 9.0.0.x-9.4.0.x, contain a cleartext storage of sensitive information vulnerability in S3 component. (CVSS 6.1, Dell PowerScale OneFS)
- [CVE-2022-25906](https://cve.now/CVE-2022-25906.md): All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes be (CVSS 7.4, is-http2)
- [CVE-2022-25916](https://cve.now/CVE-2022-25916.md): Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.sca (CVSS 7.4, mt7688-wiscan)
- [CVE-2022-45096](https://cve.now/CVE-2022-45096.md): Dell PowerScale OneFS, 8.2.0 through 9.3.0, contain an User Interface Security Issue. (CVSS 5.4, Dell PowerScale OneFS)
- [CVE-2022-45097](https://cve.now/CVE-2022-45097.md): Dell PowerScale OneFS 9.0.0.x-9.4.0.x contains an Incorrect User Management vulnerability. (CVSS 6.3, Dell PowerScale OneFS)
- [CVE-2022-45095](https://cve.now/CVE-2022-45095.md): Dell PowerScale OneFS, 8.2.x-9.4.x, contain a command injection vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2022-45101](https://cve.now/CVE-2022-45101.md): Dell PowerScale OneFS 9.0.0.x - 9.4.0.x, contains an Improper Handling of Insufficient Privileges vulnerability in NFS. (CVSS 7.3, Dell PowerScale OneFS)
- [CVE-2022-34458](https://cve.now/CVE-2022-34458.md): Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a Exposure of Sensitive System Information to an Una (CVSS 6.6, Dell Command Update)
- [CVE-2022-34459](https://cve.now/CVE-2022-34459.md): Dell Command | Update, Dell Update, and Alienware Update versions prior to 4.7 contain a improper verification of cryptographic signature i (CVSS 7.8, Dell Command Update)
- [CVE-2022-34400](https://cve.now/CVE-2022-34400.md): Dell BIOS contains a heap buffer overflow vulnerability. (CVSS 7.1, Dell CPG BIOS)
- [CVE-2022-34443](https://cve.now/CVE-2022-34443.md): Dell Rugged Control Center, versions prior to 4.5, contain an Improper Input Validation in the Service EndPoint. (CVSS 7.8, Dell Rugged Control Center)
- [CVE-2023-23928](https://cve.now/CVE-2023-23928.md): reason-jose ignores signature checks (CVSS 5.9, ulrikstrid reason-jose)
- [CVE-2023-23630](https://cve.now/CVE-2023-23630.md): Cross-site (XSS) vulnerability with Express API in Eta (CVSS 8.6, eta-dev eta · eta)
- [CVE-2021-22786](https://cve.now/CVE-2021-22786.md): A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the cont (CVSS 7.5, Schneider Electric Modicon M340 CPU · Schneider Electric… +3)
- [CVE-2022-2329](https://cve.now/CVE-2022-2329.md): A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-24324](https://cve.now/CVE-2022-24324.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leadin (CVSS 9.8, Schneider Electric IGSS Data Server)
- [CVE-2022-30904](https://cve.now/CVE-2022-30904.md): In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no c (CVSS 8.2)
- [CVE-2022-31363](https://cve.now/CVE-2022-31363.md): Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107\_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. (CVSS 8.2)
- [CVE-2022-31364](https://cve.now/CVE-2022-31364.md): Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107\_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. (CVSS 8.2)
- [CVE-2022-31902](https://cve.now/CVE-2022-31902.md): Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add(). (CVSS 5.5)
- [CVE-2022-37033](https://cve.now/CVE-2022-37033.md): In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF acces (CVSS 6.5)
- [CVE-2022-37034](https://cve.now/CVE-2022-37034.md): In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file (CVSS 5.3)
- [CVE-2022-4062](https://cve.now/CVE-2022-4062.md): A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker g (CVSS 7.8, Schneider Electric EcoStruxure Power Commission)
- [CVE-2022-4206](https://cve.now/CVE-2022-4206.md): A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Author (CVSS 5.0, GitLab DAST API scanner)
- [CVE-2022-4254](https://cve.now/CVE-2022-4254.md): sssd: libsss\_certmap fails to sanitise certificate data used in LDAP filters (CVSS 8.8, SSSD)
- [CVE-2022-42970](https://cve.now/CVE-2022-42970.md): A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a p (CVSS 9.8, Schneider Electric APC Easy UPS Online Monitoring Software…)
- [CVE-2022-42971](https://cve.now/CVE-2022-42971.md): A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker upl (CVSS 9.8, Schneider Electric APC Easy UPS Online Monitoring Software…)
- [CVE-2022-42972](https://cve.now/CVE-2022-42972.md): A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a loc (CVSS 7.8, Schneider Electric APC Easy UPS Online Monitoring Software…)
- [CVE-2022-42973](https://cve.now/CVE-2022-42973.md): A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to th (CVSS 7.8, Schneider Electric APC Easy UPS Online Monitoring Software…)
- [CVE-2022-45782](https://cve.now/CVE-2022-45782.md): An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. (CVSS 8.8)
- [CVE-2022-45783](https://cve.now/CVE-2022-45783.md): An issue was discovered in dotCMS core 4.x through 22.10.2. (CVSS 6.5)
- [CVE-2022-46934](https://cve.now/CVE-2022-46934.md): kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewCon (CVSS 6.1)
- [CVE-2022-47002](https://cve.now/CVE-2022-47002.md): A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web (no CVSS)
- [CVE-2022-47003](https://cve.now/CVE-2022-47003.md): A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request (CVSS 9.8)
- [CVE-2022-47714](https://cve.now/CVE-2022-47714.md): Last Yard 22.09.8-1 does not enforce HSTS headers (CVSS 9.8)
- [CVE-2022-47715](https://cve.now/CVE-2022-47715.md): In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic. (CVSS 5.3)
- [CVE-2022-47717](https://cve.now/CVE-2022-47717.md): Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS). (CVSS 7.5)
- [CVE-2022-47768](https://cve.now/CVE-2022-47768.md): Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal. (CVSS 7.5)
- [CVE-2022-47769](https://cve.now/CVE-2022-47769.md): An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious file (CVSS 9.8)
- [CVE-2022-47770](https://cve.now/CVE-2022-47770.md): Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection. (CVSS 9.8)
- [CVE-2022-47872](https://cve.now/CVE-2022-47872.md): A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a (no CVSS)
- [CVE-2022-48093](https://cve.now/CVE-2022-48093.md): Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin\_ ip.php. (CVSS 7.2)
- [CVE-2022-48094](https://cve.now/CVE-2022-48094.md): lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php. (CVSS 4.9)
- [CVE-2023-0454](https://cve.now/CVE-2023-0454.md): OrangeScrum version 2.0.11 allows an authenticated external attacker to delete arbitrary local files from the server. (CVSS 8.1, OrangeScrum)
- [CVE-2023-0524](https://cve.now/CVE-2023-0524.md): As part of our Security Development Lifecycle, a potential privilege escalation issue was identified internally. (CVSS 8.8, Tenable.io, Tenable.sc, Nessus)
- [CVE-2023-0587](https://cve.now/CVE-2023-0587.md): A file upload vulnerability in exists in Trend Micro Apex One server build 11110. (CVSS 9.1, Trend Micro Apex One)
- [CVE-2023-0606](https://cve.now/CVE-2023-0606.md): Cross-site Scripting (XSS) - Reflected in ampache/ampache (CVSS 9.3, ampache/ampache)
- [CVE-2023-0607](https://cve.now/CVE-2023-0607.md): Cross-site Scripting (XSS) - Stored in projectsend/projectsend (CVSS 7.2, projectsend/projectsend)
- [CVE-2023-0608](https://cve.now/CVE-2023-0608.md): Cross-site Scripting (XSS) - DOM in microweber/microweber (CVSS 6.3, microweber/microweber)
- [CVE-2023-0609](https://cve.now/CVE-2023-0609.md): Improper Authorization in wallabag/wallabag (CVSS 6.5, wallabag/wallabag)
- [CVE-2023-0610](https://cve.now/CVE-2023-0610.md): Improper Authorization in wallabag/wallabag (CVSS 5.4, wallabag/wallabag)
- [CVE-2023-20856](https://cve.now/CVE-2023-20856.md): VMware vRealize Operations (vROps) contains a CSRF bypass vulnerability. (CVSS 8.8, VMware vRealize Operations)
- [CVE-2023-23073](https://cve.now/CVE-2023-23073.md): Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via PO in the purchase component. (CVSS 6.1)
- [CVE-2023-23074](https://cve.now/CVE-2023-23074.md): Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. (CVSS 6.1)
- [CVE-2023-23075](https://cve.now/CVE-2023-23075.md): Cross Site Scripting (XSS) vulnerability in Zoho Asset Explorer 6.9 via the credential name when creating a new Assets Workstation. (CVSS 6.1)
- [CVE-2023-23076](https://cve.now/CVE-2023-23076.md): OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules. (CVSS 9.8)
- [CVE-2023-23077](https://cve.now/CVE-2023-23077.md): Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 13 via the comment field when adding a new status comment. (CVSS 6.1)
- [CVE-2023-23078](https://cve.now/CVE-2023-23078.md): Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via the comment field when changing the credentials in the (CVSS 6.1)
- [CVE-2023-23126](https://cve.now/CVE-2023-23126.md): Connectwise Automate 2022.11 is vulnerable to Clickjacking. (no CVSS)
- [CVE-2023-23127](https://cve.now/CVE-2023-23127.md): In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. (no CVSS)
- [CVE-2023-23128](https://cve.now/CVE-2023-23128.md): Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). (CVSS 6.1)
- [CVE-2023-23130](https://cve.now/CVE-2023-23130.md): Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. (no CVSS)
- [CVE-2023-23131](https://cve.now/CVE-2023-23131.md): Selfwealth iOS mobile App 3.3.1 is vulnerable to Insecure App Transport Security (ATS) Settings. (CVSS 7.5)
- [CVE-2023-23132](https://cve.now/CVE-2023-23132.md): Selfwealth iOS mobile App 3.3.1 is vulnerable to Sensitive key disclosure. (CVSS 7.5)
- [CVE-2023-23135](https://cve.now/CVE-2023-23135.md): An arbitrary file upload vulnerability in Ftdms v3.1.6 allows attackers to execute arbitrary code via uploading a crafted JPG file. (CVSS 7.2)
- [CVE-2023-23136](https://cve.now/CVE-2023-23136.md): lmxcms v1.41 was discovered to contain an arbitrary file deletion vulnerability via BackdbAction.class.php. (CVSS 6.5)
- [CVE-2023-23846](https://cve.now/CVE-2023-23846.md): Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers (CVSS 7.5, Open5GS)
- [CVE-2023-23969](https://cve.now/CVE-2023-23969.md): In Django 3.2 before 3.2.17, 4.0 before 4.0.9, and 4.1 before 4.1.6, the parsed values of Accept-Language headers are cached in order to avo (CVSS 7.5, django)
- [CVE-2023-24610](https://cve.now/CVE-2023-24610.md): NOSH 4a5cfdb allows remote authenticated users to execute PHP arbitrary code via the "practice logo" upload feature. (CVSS 8.8)
- [CVE-2023-25012](https://cve.now/CVE-2023-25012.md): The Linux kernel through 6.1.9 has a Use-After-Free in bigben\_remove in drivers/hid/hid-bigbenff.c via a crafted USB device because the LED (CVSS 4.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.