CVEs published February 3, 2023
117 CVEs were published on February 3, 2023: 35 critical, 36 high.
- Published
- 117
- Critical
- 35
- High
- 36
- Medium
- 33
- Low
- 0
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- fanzila WebFinance
- 4
- org.jeecgframework.boot:jeecg-boot-base
- 3
- jellyfin-web
- 2
- Wepa Print Away
- 2
- automad/automad
- 1
- BDCOM 1704-WGL
- 1
- Calendar Event Management System
- 1
- ckan
- 1
- Cloud Foundry Diego and CF Deployment
- 1
- Dell NetWorker, NVE
- 1
Critical 35
- CVE-2021-36424An issue discovered in phpwcms 1.9.25 allows remote attackers to run arbitrary code via DB user field during installation.
- CVE-2021-36431SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_che
- CVE-2021-36433SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_delete_m
- CVE-2021-36434SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_json_che
- CVE-2021-36484SQL injection vulnerability in JIZHICMS 1.9.5 allows attackers to run arbitrary SQL commands via add or edit article page.
- CVE-2021-36503SQL injection vulnerability in native-php-cms 1.0 allows remote attackers to run arbitrary SQL commands via the cat parameter to /list.php f
- CVE-2021-37315Incorrect Access Control issue discoverd in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attac
- CVE-2021-37317Directory Traversal vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to
- CVE-2021-37497SQL injection vulnerability in route of PbootCMS 3.0.5 allows remote attackers to run arbitrary SQL commands via crafted GET request.
- CVE-2022-31733Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another Cloud Foundry Diego and CF Deployment
- CVE-2022-48021A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.
- CVE-2023-23086Buffer OverFlow Vulnerability in MojoJson v1.2.3 allows an attacker to execute arbitrary code via the SkipString function.
- CVE-2023-23087An issue was found in MojoJson v1.2.3 allows attackers to execute arbitary code via the destroy function.
- CVE-2023-23088Buffer OverFlow Vulnerability in Barenboim json-parser master and v1.1.0 fixed in v1.1.1 allows an attacker to execute arbitrary code via th
- CVE-2023-24138TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost
- CVE-2023-24139TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag
- CVE-2023-24140TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkD
- CVE-2023-24141TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetw
- CVE-2023-24142TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetwork
- CVE-2023-24143TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetwo
- CVE-2023-24144TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg func
- CVE-2023-24145TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUs
- CVE-2023-24146TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg fu
- CVE-2023-24148TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData
- CVE-2023-24149TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for root which is stored in the component /etc/shadow.
- CVE-2023-24150A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execut
- CVE-2023-24151A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to
- CVE-2023-24152A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to exec
- CVE-2023-24153A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attacker
- CVE-2023-24154TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW.
- CVE-2023-24155TOTOLINK T8 V4.1.5cu was discovered to contain a hard code password for the telnet service which is stored in the component /web_cste/cgi-bi
- CVE-2023-24156A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute
- CVE-2023-24157A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execu
- CVE-2023-25135vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers dese
- CVE-2023-25139sprintf in the GNU C Library (glibc) 2.37 has a buffer overflow (out-of-bounds write) in some situations with a correct buffer size.
High 36
- CVE-2022-23498When query caching is enabled in Grafana users can query another users sessiongrafana
- CVE-2023-22746CKAN is vulnerable to session secret shared across instances using Docker imagesckan
- CVE-2023-0663Calendar Event Management System Login Page sql injectionCalendar Event Management System
- CVE-2023-23941SwagPayPal payment not sent to PayPal correctlyshopware SwagPayPal · swag/paypal
- CVE-2023-22474Parse Server is vulnerable to authentication bypass via spoofingparse-community parse-server · parse-server
- CVE-2023-23937Missing file upload type validation in pimcore/pimcorepimcore · pimcore/pimcore
- CVE-2023-23925Switcher Client contains Regular Expression Denial of Service (ReDoS)switcherapi switcher-client-master · switcher-client
- CVE-2023-23477IBM WebSphere Application Server code executionIBM WebSphere Application Server
- CVE-2023-24576 EMC NetWorker may potentially be vulnerable to an unauthenticated remote code execution vulnerability in the NetWorker Client execution sDell NetWorker, NVE
- CVE-2022-38396HP Factory Preinstalled Images on certain systems that shipped with Windows 10 versions 20H2 and earlier OS versions might allow escalation HP Factory Preinstalled Windows 10 20H2 Images
- CVE-2022-43779A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (systeHP PC products using AMI UEFI Firmware
- CVE-2021-36426File Upload vulnerability in phpwcms 1.9.25 allows remote attackers to run arbitrary code via crafted file upload to include/inc_lib/general
- CVE-2021-36432SQL injection vulnerability in jocms 0.8 allows remote attackers to run arbitrary SQL commands and view sentivie information via jo_set_mask
- CVE-2021-36443Cross Site Request Forgery vulnerability in imcat 5.4 allows remote attackers to escalate privilege via lack of token verification.
- CVE-2021-36444Cross Site Request Forgery (CSRF) vulnerability in imcat 5.4 allows remote attackers to gain escalated privileges via flaws one time token g
- CVE-2021-36493Buffer Overflow vulnerability in pdfimages in xpdf 4.03 allows attackers to crash the application via crafted command.
- CVE-2021-36532Race condition vulnerability discovered in portfolioCMS 1.0 allows remote attackers to run arbitrary code via fileExt parameter to localhost
- CVE-2021-36544Incorrect Access Control issue discovered in tpcms 3.2 allows remote attackers to view sensitive information via path in application URL.
- CVE-2021-36546Incorrect Access Control issue discovered in KiteCMS 1.1 allows remote attackers to view sensitive information via path in application URL.
- CVE-2021-36569Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2.
- CVE-2021-36570Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete
- CVE-2021-37304An Insecure Permissions issue in jeecg-boot 2.4.5 allows unauthenticated remote attackers to gain escalated privilege and view sensitive inforg.jeecgframework.boot:jeecg-boot-base
- CVE-2021-37305An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive informaorg.jeecgframework.boot:jeecg-boot-base
- CVE-2021-37306An Insecure Permissions issue in jeecg-boot 2.4.5 and earlier allows remote attackers to gain escalated privilege and view sensitive informaorg.jeecgframework.boot:jeecg-boot-base
- CVE-2021-37311Buffer Overflow vulnerability in fcitx5 5.0.8 allows attackers to cause a denial of service via crafted message to the application's listeni
- CVE-2021-37316SQL injection vulnerability in Cloud Disk in ASUS RT-AC68U router firmware version before 3.0.0.4.386.41634 allows remote attackers to view
- CVE-2021-37501Buffer Overflow vulnerability in HDFGroup hdf5-h5dump 1.12.0 through 1.13.0 allows attackers to cause a denial of service via h5tools_str_sp
- CVE-2022-34138Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive
- CVE-2022-45491Buffer overflow vulnerability in function json_parse_value in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (Novembe
- CVE-2022-45496Buffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (Novemb
- CVE-2022-45588All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks.
- CVE-2022-47070NVS365 V01 is vulnerable to Incorrect Access Control.
- CVE-2022-47762In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.github.com/flipped-aurora/gin-vue-admin
- CVE-2023-20854VMware Workstation contains an arbitrary file deletion vulnerability.VMware Workstation
- CVE-2023-24029In Progress WS_FTP Server before 8.8, it is possible for a host administrator to elevate their privileges via the administrative interface d
- CVE-2023-24147TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a hard code password for the telnet service which is stored in the component /etc/con
Medium, low and unrated 46
- CVE-2013-10018fanzila WebFinance save_contact.php sql injectionfanzila WebFinance
- CVE-2013-10017fanzila WebFinance save_roles.php sql injectionfanzila WebFinance
- CVE-2023-23615Malicious users in Discourse can create spam topics as any user due to improper access controldiscourse
- CVE-2022-24894Symfony storing cookie headers in HttpCachesymfony · symfony/http-kernel +1
- CVE-2022-24895Symfony vulnerable to Session Fixation of CSRF tokenssymfony · symfony/security-bundle +1
- CVE-2023-23932Specially crafted RTPS message may cause an OpenDDS application to crashOpenDDS
- CVE-2013-10016fanzila WebFinance save_taxes.php sql injectionfanzila WebFinance
- CVE-2013-10015fanzila WebFinance save_Contract_Signer_Role.php sql injectionfanzila WebFinance
- CVE-2023-23940OpenZeppelin Contracts for Cairo is vulnerable to signature validation bypassOpenZeppelin cairo-contracts · openzeppelin-cairo-contracts
- CVE-2023-23933Issue in Anomaly Detection with document and field level rules in numerical feature aggregationsopensearch-project anomaly-detection
- CVE-2023-0661Improper access control in Devolutions Server allows an authenticated user to access unauthorized sensitive data.Devolutions Server
- CVE-2023-0659BDCOM 1704-WGL Backup File param.file.tgz information disclosureBDCOM 1704-WGL
- CVE-2021-36425Directory traversal vulnerability in phpcms 1.9.25 allows remote attackers to delete arbitrary files via unfiltered $file parameter to unlin
- CVE-2021-36489Buffer Overflow vulnerability in Allegro through 5.2.6 allows attackers to cause a denial of service via crafted PCX/TGA/BMP files to allegr
- CVE-2021-36535Buffer Overflow vulnerability in Cesanta mJS 1.26 allows remote attackers to cause a denial of service via crafted .js file to mjs_set_error
- CVE-2021-36538Cross Site Scripting (XSS) vulnerability in Gurock TestRail before 7.1.2 allows remote authenticated attackers to run arbitrary code via the
- CVE-2021-36545Cross Site Scripting (XSS) vulnerability in tpcms 3.2 allows remote attackers to run arbitrary code via the cfg_copyright or cfg_tel field i
- CVE-2021-36712Cross Site Scripting (XSS) vulnerability in yzmcms 6.1 allows attackers to steal user cookies via image clipping function.
- CVE-2021-37234Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to vi
- CVE-2021-37373Cross Site Scripting (XSS) vulnerability in Teradek Slice 1st generation firmware 7.3.x and earlier allows remote attackers to run arbitrary
- CVE-2021-37374Cross Site Scripting (XSS) vulnerability in Teradek Clip all firmware versions allows remote attackers to run arbitrary code via the Friendl
- CVE-2021-37375Cross Site Scripting (XSS) vulnerability in Teradek VidiU / VidiU Mini firmware version 3.0.8 and earlier allows remote attackers to run arb
- CVE-2021-37376Cross Site Scripting (XSS) vulnerability in Teradek Bond, Bond 2 and Bond Pro firmware version 7.3.x and earlier allows remote attackers to
- CVE-2021-37377Cross Site Scripting (XSS) vulnerability in Teradek Brik firmware version 7.2.x and earlier allows remote attackers to run arbitrary code vi
- CVE-2021-37378Cross Site Scripting (XSS) vulnerability in Teradek Cube and Cube Pro firmware version 7.3.x and earlier allows remote attackers to run arbi
- CVE-2021-37379Cross Site Scripting (XSS) vulnerability in Teradek Sphere all firmware versions allows remote attackers to run arbitrary code via the Frien
- CVE-2021-37502Cross Site Scripting (XSS) vulnerability in automad 1.7.5 allows remote attackers to run arbitrary code via the user name field when adding automad/automad
- CVE-2021-37518Universal Cross Site Scripting (UXSS) vulnerability in Vimium Extension 1.66 and earlier allows remote attackers to run arbitrary code via o
- CVE-2021-37519Buffer Overflow vulnerability in authfile.c memcached 1.6.9 allows attackers to cause a denial of service via crafted authenticattion file.
- CVE-2022-42908WEPA Print Away is vulnerable to a stored XSS.Wepa Print Away
- CVE-2022-42909WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codeWepa Print Away
- CVE-2022-45492Buffer overflow vulnerability in function json_parse_number in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (Novemb
- CVE-2022-45493Buffer overflow vulnerability in function json_parse_key in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November
- CVE-2022-47130A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with admin
- CVE-2022-47131A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.
- CVE-2022-47132A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.
- CVE-2022-48022An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about
- CVE-2022-48023Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer ticke
- CVE-2022-48074An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.
- CVE-2022-48165An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to
- CVE-2023-22975A cross-site scripting (XSS) vulnerability in JFinal CMS v5.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payl
- CVE-2023-23082A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improp
- CVE-2023-23635In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS.jellyfin-web
- CVE-2023-23636In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS.jellyfin-web
- CVE-2023-24613The user interface of Array Networks AG Series and vxAG through 9.4.0.470 could allow a remote attacker to use the gdb tool to overwrite the
- CVE-2023-25136OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.