# CVEs published 2023-02-07

82 CVEs were published on February 7, 2023: 4 critical, 22 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-24828](https://cve.now/CVE-2023-24828.md): Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev (CVSS 8.1, theonedev onedev)
- [CVE-2023-0718](https://cve.now/CVE-2023-0718.md): Wicked Folders \<= 2.18.16 - Missing Authorization on ajax\_save\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0723](https://cve.now/CVE-2023-0723.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery on ajax\_move\_object (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0712](https://cve.now/CVE-2023-0712.md): Wicked Folders \<= 2.18.16 - Missing Authorization on ajax\_move\_object (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0719](https://cve.now/CVE-2023-0719.md): Wicked Folders \<= 2.18.16 - Missing Authorization on ajax\_save\_sort\_order (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0730](https://cve.now/CVE-2023-0730.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery via ajax\_save\_folder\_order (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0727](https://cve.now/CVE-2023-0727.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery via ajax\_delete\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0731](https://cve.now/CVE-2023-0731.md): Interactive Geo Maps \<= 1.5.9 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 6.4, interactivegeomaps MapGeo – Interactive Geo Maps)
- [CVE-2022-47418](https://cve.now/CVE-2022-47418.md): LogicalDOC Document Version Comment Stored XSS (CVSS 5.4, LogicalDOC Enterprise · LogicalDOC Community Edition)
- [CVE-2022-47417](https://cve.now/CVE-2022-47417.md): LogicalDOC Document File Name Stored XSS (CVSS 5.4, LogicalDOC Enterprise · LogicalDOC Community Edition)
- [CVE-2022-47419](https://cve.now/CVE-2022-47419.md): Mayan EDMS Tag XSS (CVSS 5.4, Mayan EDMS · mayan-edms)
- [CVE-2022-47416](https://cve.now/CVE-2022-47416.md): LogicalDOC Chat Stored XSS (CVSS 5.4, LogicalDOC Enterprise)
- [CVE-2022-47414](https://cve.now/CVE-2022-47414.md): If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" (CVSS 5.4, OpenKM)
- [CVE-2022-47413](https://cve.now/CVE-2022-47413.md): Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition. (CVSS 5.4, OpenKM)
- [CVE-2022-47415](https://cve.now/CVE-2022-47415.md): LogicalDOC Messaging Stored XSS (CVSS 5.4, LogicalDOC Enterprise · LogicalDOC Community Edition)
- [CVE-2023-0713](https://cve.now/CVE-2023-0713.md): Wicked Folders \<= 2.18.16 - Missing Authorization on ajax\_add\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0728](https://cve.now/CVE-2023-0728.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery on ajax\_save\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2011-10003](https://cve.now/CVE-2011-10003.md): XpressEngine Update Query sql injection (CVSS 5.5, XpressEngine)
- [CVE-2023-23931](https://cve.now/CVE-2023-23931.md): Cipher.update\_into can corrupt memory in pyca cryptography (CVSS 4.8, pyca cryptography · cryptography)
- [CVE-2023-0732](https://cve.now/CVE-2023-0732.md): SourceCodester Online Eyewear Shop POST Request Users.php registration cross site scripting (CVSS 3.5, SourceCodester Online Eyewear Shop)
- [CVE-2022-47412](https://cve.now/CVE-2022-47412.md): ONLYOFFICE Workspace Search Stored XSS (CVSS 5.4, ONLYOFFICE Workspace)
- [CVE-2023-25194](https://cve.now/CVE-2023-25194.md): Apache Kafka Connect API: Possible RCE/Denial of service attack via SASL JAAS JndiLoginModule configuration using Kafka Connect (CVSS 8.8, Apache Software Foundation Apache Kafka Connect API · org.a…)
- [CVE-2023-22735](https://cve.now/CVE-2023-22735.md): User uploads proxied from S3 lack \`Content-Security-Policy\` headers, may be served with \`Content-Disposition: inline\` in zulip (CVSS 4.4, zulip)
- [CVE-2023-24814](https://cve.now/CVE-2023-24814.md): Persisted Cross-Site Scripting in Frontend Rendering in typo3 (CVSS 8.8, typo3 · typo3/cms-core +1)
- [CVE-2023-24813](https://cve.now/CVE-2023-24813.md): URI validation failure on SVG parsing. Bypass of CVE-2023-23924 (CVSS 10.0, dompdf · dompdf/dompdf)
- [CVE-2011-10002](https://cve.now/CVE-2011-10002.md): weblabyrinth labyrinth.inc.php Labyrinth sql injection (CVSS 5.5, weblabyrinth)
- [CVE-2022-40693](https://cve.now/CVE-2022-40693.md): A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. (CVSS 5.9, Moxa SDS-3008 Series Industrial Ethernet Switch)
- [CVE-2022-40224](https://cve.now/CVE-2022-40224.md): A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. (CVSS 5.3, Moxa SDS-3008 Series Industrial Ethernet Switch)
- [CVE-2022-41313](https://cve.now/CVE-2022-41313.md): A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2 (CVSS 4.3, Moxa SDS-3008 Series Industrial Ethernet Switch)
- [CVE-2022-41312](https://cve.now/CVE-2022-41312.md): A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2 (CVSS 4.3, Moxa SDS-3008 Series Industrial Ethernet Switch)
- [CVE-2022-41311](https://cve.now/CVE-2022-41311.md): A stored cross-site scripting vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2 (CVSS 4.3, Moxa SDS-3008 Series Industrial Ethernet Switch)
- [CVE-2022-40691](https://cve.now/CVE-2022-40691.md): An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. (CVSS 5.3, Moxa SDS-3008 Series Industrial Ethernet Switch)
- [CVE-2023-0707](https://cve.now/CVE-2023-0707.md): SourceCodester Medical Certificate Generator App function.php delete\_record sql injection (CVSS 5.5, SourceCodester Medical Certificate Generator App)
- [CVE-2015-10075](https://cve.now/CVE-2015-10075.md): Custom-Content-Width custom-content-width.php register\_settings cross site scripting (CVSS 2.6, Custom-Content-Width)
- [CVE-2015-10074](https://cve.now/CVE-2015-10074.md): OpenSeaMap online\_chart index.php init cross site scripting (CVSS 3.5, OpenSeaMap online\_chart)
- [CVE-2023-23696](https://cve.now/CVE-2023-23696.md): Dell Command Intel vPro Out of Band, versions prior to 4.3.1, contain an Improper Authorization vulnerability. (CVSS 7.0, Dell Command Intel vPro Out of Band)
- [CVE-2023-0706](https://cve.now/CVE-2023-0706.md): SourceCodester Medical Certificate Generator App manage\_record.php sql injection (CVSS 6.3, SourceCodester Medical Certificate Generator App)
- [CVE-2022-42292](https://cve.now/CVE-2022-42292.md): NVIDIA GeForce Experience contains a vulnerability in the NVContainer component, where a user without administrator privileges can create a (CVSS 5.0, NVIDIA GeForce Experience)
- [CVE-2022-31611](https://cve.now/CVE-2022-31611.md): NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user leve (CVSS 6.8, NVIDIA GeForce Experience)
- [CVE-2022-42291](https://cve.now/CVE-2022-42291.md): NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may ina (CVSS 8.2, NVIDIA GeForce Experience)
- [CVE-2023-24827](https://cve.now/CVE-2023-24827.md): Credential disclosure in syft when SYFT\_ATTEST\_PASSWORD environment variable set in syft (CVSS 6.5, anchore syft · github.com/anchore/syft)
- [CVE-2023-24808](https://cve.now/CVE-2023-24808.md): Denial Of Service when opening a corrupt PDF file in pdfio (CVSS 5.3, michaelrsweet pdfio)
- [CVE-2021-36471](https://cve.now/CVE-2021-36471.md): Directory Traversal vulnerability in AdminLTE 3.1.0 allows remote attackers to gain escalated privilege and view sensitive information via / (CVSS 9.8)
- [CVE-2021-37491](https://cve.now/CVE-2021-37491.md): An issue discovered in src/wallet/wallet.cpp in Dogecoin Project Dogecoin Core 1.14.3 and earlier allows attackers to view sensitive informa (CVSS 7.5)
- [CVE-2021-37492](https://cve.now/CVE-2021-37492.md): An issue discovered in src/wallet/wallet.cpp in Ravencoin Core 4.3.2.1 and earlier allows attackers to view sensitive information via CWalle (CVSS 7.5)
- [CVE-2022-21948](https://cve.now/CVE-2022-21948.md): paste: XSS on the image upload function (CVSS 4.3, openSUSE paste)
- [CVE-2022-21953](https://cve.now/CVE-2022-21953.md): Authenticated user can gain unauthorized shell pod and kubectl access in the local cluster (CVSS 7.4, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2022-24990](https://cve.now/CVE-2022-24990.md): TerraMaster NAS 4.2.29 and earlier allows remote attackers to discover the administrative password by sending "User-Agent: TNAS" to module/a (CVSS 9.8, KEV)
- [CVE-2022-31249](https://cve.now/CVE-2022-31249.md): \[RANCHER\] OS command injection in Rancher and Fleet (CVSS 7.5, SUSE Rancher · github.com/rancher/wrangler)
- [CVE-2022-31254](https://cve.now/CVE-2022-31254.md): rmt-server-pubcloud allows to escalate from user \_rmt to root (CVSS 7.8, SUSE Linux Enterprise Server for SAP · SUSE Manager Serv… +1)
- [CVE-2022-38547](https://cve.now/CVE-2022-38547.md): A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN (CVSS 7.2, Zyxel ZyWALL/USG series firmware · Zyxel VPN series firm… +2)
- [CVE-2022-40480](https://cve.now/CVE-2022-40480.md): Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial o (CVSS 6.5)
- [CVE-2022-43755](https://cve.now/CVE-2022-43755.md): Rancher: Non-random authentication token (CVSS 7.1, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2022-43756](https://cve.now/CVE-2022-43756.md): Rancher/Wrangler: Denial of service when processing Git credentials (CVSS 5.9, SUSE Rancher · github.com/rancher/wrangler)
- [CVE-2022-43757](https://cve.now/CVE-2022-43757.md): Rancher: Exposure of sensitive fields (CVSS 9.9, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2022-43758](https://cve.now/CVE-2022-43758.md): Rancher: Command injection in Git package (CVSS 7.6, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2022-43759](https://cve.now/CVE-2022-43759.md): Rancher: Privilege escalation via promoted roles (CVSS 7.2, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2022-45190](https://cve.now/CVE-2022-45190.md): An issue was discovered on Microchip RN4870 1.43 devices. (CVSS 5.3)
- [CVE-2022-45191](https://cve.now/CVE-2022-45191.md): An issue was discovered on Microchip RN4870 1.43 devices. (CVSS 6.5)
- [CVE-2022-45192](https://cve.now/CVE-2022-45192.md): An issue was discovered on Microchip RN4870 1.43 devices. (CVSS 6.5)
- [CVE-2022-45441](https://cve.now/CVE-2022-45441.md): A cross-site scripting (XSS) vulnerability in Zyxel NBG-418N v2 firmware versions prior to V1.00(AARP.13)C0, which could allow an attacker t (CVSS 6.1, Zyxel NBG-418N v2 firmware)
- [CVE-2022-45544](https://cve.now/CVE-2022-45544.md): Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code (CVSS 8.8)
- [CVE-2022-45768](https://cve.now/CVE-2022-45768.md): Command Injection vulnerability in Edimax Technology Co., Ltd. (CVSS 8.8)
- [CVE-2022-45854](https://cve.now/CVE-2022-45854.md): An improper check for unusual conditions in Zyxel NWA110AX firmware verisons prior to 6.50(ABTG.0)C0, which could allow a LAN attacker to ca (CVSS 4.3, Zyxel NWA110AX firmware)
- [CVE-2022-46285](https://cve.now/CVE-2022-46285.md): A flaw was found in libXpm. (CVSS 7.5, libXpm)
- [CVE-2022-46663](https://cve.now/CVE-2022-46663.md): In GNU Less before 609, crafted data can result in "less -R" not filtering ANSI escape sequences sent to the terminal. (CVSS 7.5)
- [CVE-2022-4883](https://cve.now/CVE-2022-4883.md): A flaw was found in libXpm. (CVSS 8.8, libXpm)
- [CVE-2023-0696](https://cve.now/CVE-2023-0696.md): Type confusion in V8 in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2023-0697](https://cve.now/CVE-2023-0697.md): Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 110.0.5481.77 allowed a remote attacker to spoof the c (no CVSS, Google Chrome)
- [CVE-2023-0698](https://cve.now/CVE-2023-0698.md): Out of bounds read in WebRTC in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 8.8, Google Chrome)
- [CVE-2023-0699](https://cve.now/CVE-2023-0699.md): Use after free in GPU in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-0700](https://cve.now/CVE-2023-0700.md): Inappropriate implementation in Download in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to potentially spoof the contents (CVSS 6.5, Google Chrome)
- [CVE-2023-0701](https://cve.now/CVE-2023-0701.md): Heap buffer overflow in WebUI in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific U (no CVSS, Google Chrome)
- [CVE-2023-0702](https://cve.now/CVE-2023-0702.md): Type confusion in Data Transfer in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific (no CVSS, Google Chrome)
- [CVE-2023-0703](https://cve.now/CVE-2023-0703.md): Type confusion in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who convinced a user to engage in specific UI i (no CVSS, Google Chrome)
- [CVE-2023-0704](https://cve.now/CVE-2023-0704.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 110.0.5481.77 allowed a remote attacker to bypass same origin policy a (CVSS 6.5, Google Chrome)
- [CVE-2023-0705](https://cve.now/CVE-2023-0705.md): Integer overflow in Core in Google Chrome prior to 110.0.5481.77 allowed a remote attacker who had one a race condition to potentially explo (CVSS 7.5, Google Chrome)
- [CVE-2023-0735](https://cve.now/CVE-2023-0735.md): Cross-Site Request Forgery (CSRF) in wallabag/wallabag (CVSS 6.5, wallabag/wallabag)
- [CVE-2023-0736](https://cve.now/CVE-2023-0736.md): Cross-site Scripting (XSS) - Stored in wallabag/wallabag (CVSS 4.6, wallabag/wallabag)
- [CVE-2023-22643](https://cve.now/CVE-2023-22643.md): libzypp-plugin-appdata: potential arbitrary code execution via shell injection due to \`os.system\` calls (CVSS 6.3, SUSE Linux Enterprise Server for SAP 15-SP3 · openSUSE Leap)
- [CVE-2023-23011](https://cve.now/CVE-2023-23011.md): Cross Site Scripting (XSS) vulnerability in InvoicePlane 1.6 via filter\_product input to file modal\_product\_lookups.php. (CVSS 6.1)
- [CVE-2023-23026](https://cve.now/CVE-2023-23026.md): Cross site scripting (XSS) vulnerability in sourcecodester oretnom23 sales management system 1.0, allows attackers to execute arbitrary code (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.