# CVEs published 2023-02-04

14 CVEs were published on February 4, 2023: 1 critical, 3 high. Days are UTC.

- [CVE-2022-45786](https://cve.now/CVE-2022-45786.md): Apache AGE: Python and Golang drivers allow data manipulation and exposure due to SQL injection (CVSS 8.1, Apache Software Foundation Apache AGE · github.com/apach… +1)
- [CVE-2023-22849](https://cve.now/CVE-2023-22849.md): Apache Sling App CMS: XSS in CMS Reference / UI Components (CVSS 6.1, Apache Software Foundation Apache Sling App CMS · org.apach…)
- [CVE-2019-25101](https://cve.now/CVE-2019-25101.md): OnShift TurboGears HTTP Header controllers.py response splitting (CVSS 6.3, OnShift TurboGears · turbogears)
- [CVE-2018-25080](https://cve.now/CVE-2018-25080.md): MobileDetect Example session\_example.php initLayoutType cross site scripting (CVSS 3.5, MobileDetect · mobiledetect/mobiledetectlib)
- [CVE-2023-0675](https://cve.now/CVE-2023-0675.md): Calendar Event Management System sql injection (CVSS 6.3, Calendar Event Management System)
- [CVE-2023-0674](https://cve.now/CVE-2023-0674.md): XXL-JOB New Password updatePwd cross-site request forgery (CVSS 4.3, XXL-JOB · com.xuxueli:xxl-job)
- [CVE-2023-0673](https://cve.now/CVE-2023-0673.md): SourceCodester Online Eyewear Shop sql injection (CVSS 5.0, SourceCodester Online Eyewear Shop)
- [CVE-2018-25079](https://cve.now/CVE-2018-25079.md): Segmentio is-url index.js redos (CVSS 4.3, Segmentio is-url · is-url)
- [CVE-2015-10072](https://cve.now/CVE-2015-10072.md): NREL api-umbrella-web Flash Message cross site scripting (CVSS 3.5, NREL api-umbrella-web)
- [CVE-2023-0671](https://cve.now/CVE-2023-0671.md): Code Injection in froxlor/froxlor (CVSS 9.9, froxlor/froxlor)
- [CVE-2023-0676](https://cve.now/CVE-2023-0676.md): Cross-site Scripting (XSS) - Reflected in phpipam/phpipam (CVSS 2.4, phpipam/phpipam)
- [CVE-2023-0677](https://cve.now/CVE-2023-0677.md): Cross-site Scripting (XSS) - Reflected in phpipam/phpipam (CVSS 4.4, phpipam/phpipam)
- [CVE-2023-0678](https://cve.now/CVE-2023-0678.md): Missing Authorization in phpipam/phpipam (CVSS 7.5, phpipam/phpipam)
- [CVE-2023-25193](https://cve.now/CVE-2023-25193.md): hb-ot-layout-gsubgpos.hh in HarfBuzz through 6.0.0 allows attackers to trigger O(n^2) growth via consecutive marks during the process of loo (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.