CVEs published February 2, 2023
50 CVEs were published on February 2, 2023: 6 critical, 15 high.
- Published
- 50
- Critical
- 6
- High
- 15
- Medium
- 25
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- dst-admin
- 4
- Delta Industrial Automation DOPSoft
- 2
- IBM Tivoli Workload Scheduler
- 2
- in2code/femanager
- 2
- Mitsubishi Electric GOT2000 Series GT27 model · Mitsubis… +1
- 2
- squidex/squidex
- 2
- TRENDnet TEW-652BRP
- 2
- TRENDnet TEW-811DRU
- 2
- All-in-One WP Migration
- 1
- clockwork_web
- 1
Critical 6
- CVE-2022-22486IBM Tivoli Workload Scheduler XML external entity injectionIBM Tivoli Workload Scheduler
- CVE-2022-48079Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code vi
- CVE-2022-48082Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
- CVE-2022-48113A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST
- CVE-2022-48114RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
- CVE-2022-48130Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNe
High 15
- CVE-2023-0124CVE-2023-0124Delta Industrial Automation DOPSoft
- CVE-2023-0123CVE-2023-0123Delta Industrial Automation DOPSoft
- CVE-2022-4634CVE-2022-4634Delta Industrial Automation ScreenEditor · Delta Industrial…
- CVE-2022-38657An open redirect to malicious sites affects HCL LeapHCL Software Leap
- CVE-2022-38389IBM Tivoli Workload Scheduler XML external entity injectionIBM Tivoli Workload Scheduler
- CVE-2023-24574 Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication compoDell Enterprise SONiC OS
- CVE-2023-0640TRENDnet TEW-652BRP Web Interface ping.ccp command injectionTRENDnet TEW-652BRP
- CVE-2023-0638TRENDnet TEW-811DRU Web Interface command injectionTRENDnet TEW-811DRU
- CVE-2022-33323Authentication Bypass Vulnerability in Robot Controller of MELFA SD/SQ series and F-seriesMitsubishi Electric MELFA SD/SQ Series Controller CR1D… +442
- CVE-2022-46552D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist
- CVE-2022-46604An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a craft
- CVE-2022-46965PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.
- CVE-2023-23110An exploitable firmware modification vulnerability was discovered in certain Netgear products.
- CVE-2023-25013An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3.in2code/femanager
- CVE-2023-25014An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3.in2code/femanager
Medium, low and unrated 29
- CVE-2023-0658Multilaser RE057/RE170 Backup File param.file.tgz information disclosureMultilaser RE057 · Multilaser RE170
- CVE-2022-46842WordPress JS Help Desk plugin <= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF)JS Help Desk
- CVE-2022-46815WordPress Conditional Shipping for WooCommerce Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)Lauri Karisola / WP Trio Conditional Shipping for WooCommer…
- CVE-2022-45807WordPress WP Mail Log Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)WPVibes WP Mail Log
- CVE-2022-45067WordPress Exclusive Addons Elementor Plugin <= 2.6.1 is vulnerable to Cross Site Request Forgery (CSRF)DevsCred Exclusive Addons for Elementor
- CVE-2022-40692WordPress Sunshine Photo Cart Plugin <= 2.9.13 is vulnerable to Cross Site Request Forgery (CSRF)WP Sunshine Sunshine Photo Cart
- CVE-2022-44585WordPress Homepage Pop-up Plugin <= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF)Magneticlab Sàrl Homepage Pop-up
- CVE-2022-36401WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)StandaloneTech TeraWallet – For WooCommerce
- CVE-2023-0651FastCMS Template Management unrestricted uploadFastCMS
- CVE-2023-0650YAFNET Signature cross site scriptingYAFNET
- CVE-2023-0649dst-admin sendBroadcast command injectiondst-admin
- CVE-2023-0648dst-admin masterConsole command injectiondst-admin
- CVE-2023-0647dst-admin kickPlayer command injectiondst-admin
- CVE-2023-0646dst-admin cavesConsole command injectiondst-admin
- CVE-2022-43665A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645.ESTsoft Alyac
- CVE-2022-2546All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSSAll-in-One WP Migration
- CVE-2023-0641PHPGurukul Employee Leaves Management System changepassword.php weak passwordPHPGurukul Employee Leaves Management System
- CVE-2023-0639TRENDnet TEW-652BRP Web Management Interface get_set.ccp cross site scriptingTRENDnet TEW-652BRP
- CVE-2023-0637TRENDnet TEW-811DRU Web Management Interface wan.asp memory corruptionTRENDnet TEW-811DRU
- CVE-2022-40269Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000Mitsubishi Electric GOT2000 Series GT27 model · Mitsubis… +1
- CVE-2022-40268Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.Mitsubishi Electric GOT2000 Series GT27 model · Mitsubis… +1
- CVE-2020-24307An issue in mRemoteNG v1.76.20 allows attackers to escalate privileges via a crafted executable file.
- CVE-2022-3560A flaw was found in pesign.pesign
- CVE-2022-48140DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filena
- CVE-2023-0642Cross-Site Request Forgery (CSRF) in squidex/squidexsquidex/squidex
- CVE-2023-0643Improper Handling of Additional Special Element in squidex/squidexsquidex/squidex
- CVE-2023-23119The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmwar
- CVE-2023-23120The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera f
- CVE-2023-25015Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF.clockwork_web