CVEs published February 7, 2023
82 CVEs were published on February 7, 2023: 4 critical, 22 high. 1 is now in CISA KEV.
- Published
- 82
- Critical
- 4
- High
- 22
- Medium
- 48
- Low
- 3
- Unrated
- 5
- Now in CISA KEV
- 1
- Fix available
- 37
Most affected products
- Google Chrome
- 10
- wickedplugins Wicked Folders – Folder Organizer for Pages,…
- 8
- Moxa SDS-3008 Series Industrial Ethernet Switch
- 6
- SUSE Rancher · github.com/rancher/rancher
- 5
- LogicalDOC Enterprise · LogicalDOC Community Edition
- 3
- NVIDIA GeForce Experience
- 3
- libXpm
- 2
- OpenKM
- 2
- SourceCodester Medical Certificate Generator App
- 2
- SUSE Rancher · github.com/rancher/wrangler
- 2
Critical 4
- CVE-2023-24813URI validation failure on SVG parsing. Bypass of CVE-2023-23924dompdf · dompdf/dompdf
- CVE-2021-36471Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via /
- CVE-2022-24990TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/a
- CVE-2022-43757Rancher: Exposure of sensitive fieldsSUSE Rancher · github.com/rancher/rancher
High 22
- CVE-2023-24828Use of Cryptographically Weak Pseudo-Random Number Generator in Onedevtheonedev onedev
- CVE-2023-25194Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect Apache Software Foundation Apache Kafka Connect API · org.a…
- CVE-2023-24814Persisted Cross-Site Scripting in Frontend Rendering in typo3typo3 · typo3/cms-core +1
- CVE-2023-23696 Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability.Dell Command Intel vPro Out of Band
- CVE-2022-42291 NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inaNVIDIA GeForce Experience
- CVE-2021-37491An issue discovered in src/wallet/wallet.cpp in Dogecoin Project Dogecoin Core 1.14.3 and earlier allows attackers to view sensitive informa
- CVE-2021-37492An issue discovered in src/wallet/wallet.cpp in Ravencoin Core 4.3.2.1 and earlier allows attackers to view sensitive information via CWalle
- CVE-2022-21953Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster SUSE Rancher · github.com/rancher/rancher
- CVE-2022-31249[RANCHER] OS command injection in Rancher and FleetSUSE Rancher · github.com/rancher/wrangler
- CVE-2022-31254rmt-server-pubcloud allows to escalate from user _rmt to rootSUSE Linux Enterprise Server for SAP · SUSE Manager Serv… +1
- CVE-2022-38547A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPNZyxel ZyWALL/USG series firmware · Zyxel VPN series firm… +2
- CVE-2022-43755Rancher: Non-random authentication tokenSUSE Rancher · github.com/rancher/rancher
- CVE-2022-43758Rancher: Command injection in Git packageSUSE Rancher · github.com/rancher/rancher
- CVE-2022-43759Rancher: Privilege escalation via promoted rolesSUSE Rancher · github.com/rancher/rancher
- CVE-2022-45544Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code
- CVE-2022-45768Command Injection vulnerability in Edimax Technology Co., Ltd.
- CVE-2022-46285A flaw was found in libXpm.libXpm
- CVE-2022-46663In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal.
- CVE-2022-4883A flaw was found in libXpm.libXpm
- CVE-2023-0698Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via aGoogle Chrome
- CVE-2023-0699Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-0705Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially exploGoogle Chrome
Medium, low and unrated 56
- CVE-2023-0718Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0723Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_move_objectwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0712Wicked Folders <= 2.18.16 - Missing Authorization on ajax_move_objectwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0719Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_sort_orderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0730Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_folder_orderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0727Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_delete_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0731Interactive Geo Maps <= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scriptinginteractivegeomaps MapGeo – Interactive Geo Maps
- CVE-2022-47418LogicalDOC Document Version Comment Stored XSSLogicalDOC Enterprise · LogicalDOC Community Edition
- CVE-2022-47417LogicalDOC Document File Name Stored XSSLogicalDOC Enterprise · LogicalDOC Community Edition
- CVE-2022-47419Mayan EDMS Tag XSSMayan EDMS · mayan-edms
- CVE-2022-47416LogicalDOC Chat Stored XSSLogicalDOC Enterprise
- CVE-2022-47414 If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" OpenKM
- CVE-2022-47413 Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.OpenKM
- CVE-2022-47415LogicalDOC Messaging Stored XSSLogicalDOC Enterprise · LogicalDOC Community Edition
- CVE-2023-0713Wicked Folders <= 2.18.16 - Missing Authorization on ajax_add_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0728Wicked Folders <= 2.18.16 - Cross-Site Request Forgery on ajax_save_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2011-10003XpressEngine Update Query sql injectionXpressEngine
- CVE-2023-23931Cipher.update_into can corrupt memory in pyca cryptographypyca cryptography · cryptography
- CVE-2023-0732SourceCodester Online Eyewear Shop POST Request Users.php registration cross site scriptingSourceCodester Online Eyewear Shop
- CVE-2022-47412ONLYOFFICE Workspace Search Stored XSSONLYOFFICE Workspace
- CVE-2023-22735User uploads proxied from S3 lack `Content-Security-Policy` headers, may be served with `Content-Disposition: inline` in zulipzulip
- CVE-2011-10002weblabyrinth labyrinth.inc.php Labyrinth sql injectionweblabyrinth
- CVE-2022-40693A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.Moxa SDS-3008 Series Industrial Ethernet Switch
- CVE-2022-40224A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.Moxa SDS-3008 Series Industrial Ethernet Switch
- CVE-2022-41313A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2Moxa SDS-3008 Series Industrial Ethernet Switch
- CVE-2022-41312A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2Moxa SDS-3008 Series Industrial Ethernet Switch
- CVE-2022-41311A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2Moxa SDS-3008 Series Industrial Ethernet Switch
- CVE-2022-40691An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.Moxa SDS-3008 Series Industrial Ethernet Switch
- CVE-2023-0707SourceCodester Medical Certificate Generator App function.php delete_record sql injectionSourceCodester Medical Certificate Generator App
- CVE-2015-10075Custom-Content-Width custom-content-width.php register_settings cross site scriptingCustom-Content-Width
- CVE-2015-10074OpenSeaMap online_chart index.php init cross site scriptingOpenSeaMap online_chart
- CVE-2023-0706SourceCodester Medical Certificate Generator App manage_record.php sql injectionSourceCodester Medical Certificate Generator App
- CVE-2022-42292 NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create aNVIDIA GeForce Experience
- CVE-2022-31611 NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user leveNVIDIA GeForce Experience
- CVE-2023-24827Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set in syftanchore syft · github.com/anchore/syft
- CVE-2023-24808Denial Of Service when opening a corrupt PDF file in pdfiomichaelrsweet pdfio
- CVE-2022-21948paste: XSS on the image upload functionopenSUSE paste
- CVE-2022-40480Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial o
- CVE-2022-43756Rancher/Wrangler: Denial of service when processing Git credentialsSUSE Rancher · github.com/rancher/wrangler
- CVE-2022-45190An issue was discovered on Microchip RN4870 1.43 devices.
- CVE-2022-45191An issue was discovered on Microchip RN4870 1.43 devices.
- CVE-2022-45192An issue was discovered on Microchip RN4870 1.43 devices.
- CVE-2022-45441A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker tZyxel NBG-418N v2 firmware
- CVE-2022-45854An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to caZyxel NWA110AX firmware
- CVE-2023-0696Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2023-0697Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the cGoogle Chrome
- CVE-2023-0700Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contentsGoogle Chrome
- CVE-2023-0701Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UGoogle Chrome
- CVE-2023-0702Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specificGoogle Chrome
- CVE-2023-0703Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI iGoogle Chrome
- CVE-2023-0704Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy aGoogle Chrome
- CVE-2023-0735Cross-Site Request Forgery (CSRF) in wallabag/wallabagwallabag/wallabag
- CVE-2023-0736Cross-site Scripting (XSS) - Stored in wallabag/wallabagwallabag/wallabag
- CVE-2023-22643libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to `os.system` callsSUSE Linux Enterprise Server for SAP 15-SP3 · openSUSE Leap
- CVE-2023-23011Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter_product input to file modal_product_lookups.php.
- CVE-2023-23026Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary code