# CVEs published 2023-02-02

50 CVEs were published on February 2, 2023: 6 critical, 15 high. Days are UTC.

- [CVE-2023-0124](https://cve.now/CVE-2023-0124.md): CVE-2023-0124 (CVSS 7.8, Delta Industrial Automation DOPSoft)
- [CVE-2023-0123](https://cve.now/CVE-2023-0123.md): CVE-2023-0123 (CVSS 7.8, Delta Industrial Automation DOPSoft)
- [CVE-2022-4634](https://cve.now/CVE-2022-4634.md): CVE-2022-4634 (CVSS 7.8, Delta Industrial Automation ScreenEditor · Delta Industrial…)
- [CVE-2022-38657](https://cve.now/CVE-2022-38657.md): An open redirect to malicious sites affects HCL Leap (CVSS 8.2, HCL Software Leap)
- [CVE-2023-0658](https://cve.now/CVE-2023-0658.md): Multilaser RE057/RE170 Backup File param.file.tgz information disclosure (CVSS 5.3, Multilaser RE057 · Multilaser RE170)
- [CVE-2022-38389](https://cve.now/CVE-2022-38389.md): IBM Tivoli Workload Scheduler XML external entity injection (CVSS 7.1, IBM Tivoli Workload Scheduler)
- [CVE-2022-22486](https://cve.now/CVE-2022-22486.md): IBM Tivoli Workload Scheduler XML external entity injection (CVSS 10.0, IBM Tivoli Workload Scheduler)
- [CVE-2022-46842](https://cve.now/CVE-2022-46842.md): WordPress JS Help Desk plugin \<= 2.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, JS Help Desk)
- [CVE-2022-46815](https://cve.now/CVE-2022-46815.md): WordPress Conditional Shipping for WooCommerce Plugin \<= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Lauri Karisola / WP Trio Conditional Shipping for WooCommer…)
- [CVE-2022-45807](https://cve.now/CVE-2022-45807.md): WordPress WP Mail Log Plugin \<= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WPVibes WP Mail Log)
- [CVE-2022-45067](https://cve.now/CVE-2022-45067.md): WordPress Exclusive Addons Elementor Plugin \<= 2.6.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, DevsCred Exclusive Addons for Elementor)
- [CVE-2023-24574](https://cve.now/CVE-2023-24574.md): Dell Enterprise SONiC OS, 3.5.3, 4.0.0, 4.0.1, 4.0.2, contains an "Uncontrolled Resource Consumption vulnerability" in authentication compo (CVSS 7.5, Dell Enterprise SONiC OS)
- [CVE-2022-40692](https://cve.now/CVE-2022-40692.md): WordPress Sunshine Photo Cart Plugin \<= 2.9.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WP Sunshine Sunshine Photo Cart)
- [CVE-2022-44585](https://cve.now/CVE-2022-44585.md): WordPress Homepage Pop-up Plugin \<= 1.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Magneticlab Sàrl Homepage Pop-up)
- [CVE-2022-36401](https://cve.now/CVE-2022-36401.md): WordPress TeraWallet – For WooCommerce Plugin \<= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, StandaloneTech TeraWallet – For WooCommerce)
- [CVE-2023-0651](https://cve.now/CVE-2023-0651.md): FastCMS Template Management unrestricted upload (CVSS 5.3, FastCMS)
- [CVE-2023-0650](https://cve.now/CVE-2023-0650.md): YAFNET Signature cross site scripting (CVSS 3.5, YAFNET)
- [CVE-2023-0649](https://cve.now/CVE-2023-0649.md): dst-admin sendBroadcast command injection (CVSS 6.3, dst-admin)
- [CVE-2023-0648](https://cve.now/CVE-2023-0648.md): dst-admin masterConsole command injection (CVSS 6.3, dst-admin)
- [CVE-2023-0647](https://cve.now/CVE-2023-0647.md): dst-admin kickPlayer command injection (CVSS 6.3, dst-admin)
- [CVE-2023-0646](https://cve.now/CVE-2023-0646.md): dst-admin cavesConsole command injection (CVSS 6.3, dst-admin)
- [CVE-2022-43665](https://cve.now/CVE-2022-43665.md): A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645. (CVSS 5.0, ESTsoft Alyac)
- [CVE-2022-2546](https://cve.now/CVE-2022-2546.md): All-in-One WP Migration \< 7.63 - Unauthenticated Reflected XSS (CVSS 4.7, All-in-One WP Migration)
- [CVE-2023-0641](https://cve.now/CVE-2023-0641.md): PHPGurukul Employee Leaves Management System changepassword.php weak password (CVSS 3.7, PHPGurukul Employee Leaves Management System)
- [CVE-2023-0640](https://cve.now/CVE-2023-0640.md): TRENDnet TEW-652BRP Web Interface ping.ccp command injection (CVSS 7.2, TRENDnet TEW-652BRP)
- [CVE-2023-0639](https://cve.now/CVE-2023-0639.md): TRENDnet TEW-652BRP Web Management Interface get\_set.ccp cross site scripting (CVSS 2.4, TRENDnet TEW-652BRP)
- [CVE-2023-0638](https://cve.now/CVE-2023-0638.md): TRENDnet TEW-811DRU Web Interface command injection (CVSS 7.2, TRENDnet TEW-811DRU)
- [CVE-2023-0637](https://cve.now/CVE-2023-0637.md): TRENDnet TEW-811DRU Web Management Interface wan.asp memory corruption (CVSS 6.5, TRENDnet TEW-811DRU)
- [CVE-2022-40269](https://cve.now/CVE-2022-40269.md): Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000 (CVSS 6.8, Mitsubishi Electric GOT2000 Series GT27 model · Mitsubis… +1)
- [CVE-2022-40268](https://cve.now/CVE-2022-40268.md): Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01. (CVSS 6.1, Mitsubishi Electric GOT2000 Series GT27 model · Mitsubis… +1)
- [CVE-2022-33323](https://cve.now/CVE-2022-33323.md): Authentication Bypass Vulnerability in Robot Controller of MELFA SD/SQ series and F-series (CVSS 7.5, Mitsubishi Electric MELFA SD/SQ Series Controller CR1D… +442)
- [CVE-2020-24307](https://cve.now/CVE-2020-24307.md): An issue in mRemoteNG v1.76.20 allows attackers to escalate privileges via a crafted executable file. (no CVSS)
- [CVE-2022-3560](https://cve.now/CVE-2022-3560.md): A flaw was found in pesign. (CVSS 5.5, pesign)
- [CVE-2022-46552](https://cve.now/CVE-2022-46552.md): D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)\_dhcps\_staticlist (CVSS 8.8)
- [CVE-2022-46604](https://cve.now/CVE-2022-46604.md): An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a craft (CVSS 8.8)
- [CVE-2022-46965](https://cve.now/CVE-2022-46965.md): PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability. (CVSS 8.1)
- [CVE-2022-48079](https://cve.now/CVE-2022-48079.md): Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code vi (CVSS 9.8)
- [CVE-2022-48082](https://cve.now/CVE-2022-48082.md): Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag. (CVSS 9.8)
- [CVE-2022-48113](https://cve.now/CVE-2022-48113.md): A vulnerability in TOTOLINK N200RE\_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST (CVSS 9.8)
- [CVE-2022-48114](https://cve.now/CVE-2022-48114.md): RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable. (CVSS 9.8)
- [CVE-2022-48130](https://cve.now/CVE-2022-48130.md): Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNe (CVSS 9.8)
- [CVE-2022-48140](https://cve.now/CVE-2022-48140.md): DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file\_manage\_view.php?fmdo=edit&filena (CVSS 5.4)
- [CVE-2023-0642](https://cve.now/CVE-2023-0642.md): Cross-Site Request Forgery (CSRF) in squidex/squidex (CVSS 6.8, squidex/squidex)
- [CVE-2023-0643](https://cve.now/CVE-2023-0643.md): Improper Handling of Additional Special Element in squidex/squidex (CVSS 5.4, squidex/squidex)
- [CVE-2023-23110](https://cve.now/CVE-2023-23110.md): An exploitable firmware modification vulnerability was discovered in certain Netgear products. (CVSS 7.4)
- [CVE-2023-23119](https://cve.now/CVE-2023-23119.md): The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmwar (CVSS 5.9)
- [CVE-2023-23120](https://cve.now/CVE-2023-23120.md): The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes TRENDnet TV-IP651WI Network Camera f (CVSS 5.9)
- [CVE-2023-25013](https://cve.now/CVE-2023-25013.md): An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. (CVSS 8.6, in2code/femanager)
- [CVE-2023-25014](https://cve.now/CVE-2023-25014.md): An issue was discovered in the femanager extension before 5.5.3, 6.x before 6.3.4, and 7.x before 7.1.0 for TYPO3. (CVSS 8.6, in2code/femanager)
- [CVE-2023-25015](https://cve.now/CVE-2023-25015.md): Clockwork Web before 0.1.2, when Rails before 5.2 is used, allows CSRF. (CVSS 6.5, clockwork\_web)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.