CVEs published February 8, 2023
72 CVEs were published on February 8, 2023: 8 critical, 26 high.
- Published
- 72
- Critical
- 8
- High
- 26
- Medium
- 37
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- wickedplugins Wicked Folders – Folder Organizer for Pages,…
- 11
- Group Arge Energy and Control Systems Smartpower Web
- 7
- answerdev/answer · github.com/answerdev/answer
- 6
- OpenSSL · openssl-src
- 6
- B&R Industrial Automation B&R APROL
- 5
- Delta Electronics DIAScreen
- 3
- btcpayserver/btcpayserver
- 2
- Palo Alto Networks Cortex XDR agent
- 2
- pterodactyl wings · github.com/pterodactyl/wings
- 2
- argoproj argo-cd · github.com/argoproj/argo-cd/v2
- 1
Critical 8
- CVE-2023-25168Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wingspterodactyl wings · github.com/pterodactyl/wings
- CVE-2022-45088Local File Inclusion in Smartpower WebGroup Arge Energy and Control Systems Smartpower Web
- CVE-2022-43764Buffer overflow when changing configuration on Tbase ServerB&R Industrial Automation B&R APROL
- CVE-2022-43761Lack of authentication when managing APROL databaseB&R Industrial Automation B&R APROL
- CVE-2022-45526SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via t
- CVE-2022-45527File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to directly upload malic
- CVE-2022-45982thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability.topthink/think
- CVE-2023-0744Improper Access Control in answerdev/answeranswerdev/answer · github.com/answerdev/answer
High 26
- CVE-2023-0251CVE-2023-0251Delta Electronics DIAScreen
- CVE-2023-0250CVE-2023-0250Delta Electronics DIAScreen
- CVE-2023-0249CVE-2023-0249Delta Electronics DIAScreen
- CVE-2023-25164Sensitive Information leak via Script File in TinaCMStinacms · @tinacms/cli
- CVE-2023-25151DoS vulnerability for high cardinality metrics in opentelemetry-go-contribopen-telemetry opentelemetry-go-contrib · go.opentelemet… +1
- CVE-2022-45090SQL Injection in Smartpower WebGroup Arge Energy and Control Systems Smartpower Web
- CVE-2022-45089SQL Injection in Smartpower WebGroup Arge Energy and Control Systems Smartpower Web
- CVE-2022-4450Double free after calling PEM_read_bio_exOpenSSL · openssl-src
- CVE-2023-0215Use-after-free following BIO_new_NDEFOpenSSL · openssl-src
- CVE-2023-0216Invalid pointer dereference in d2i_PKCS7 functionsOpenSSL · openssl-src
- CVE-2023-0217NULL dereference validating DSA public keyOpenSSL · openssl-src
- CVE-2023-0286X.400 address type confusion in X.509 GeneralNameOpenSSL · cryptography +1
- CVE-2023-0401NULL dereference during PKCS7 data verificationOpenSSL · openssl-src
- CVE-2022-42438IBM Cloud Pak for Multicloud Management Monitoring privilege escalationIBM Cloud Pak for Multicloud Management Monitoring
- CVE-2023-25152Symbolic Link (Symlink) Following in github.com/pterodactyl/wingspterodactyl wings · github.com/pterodactyl/wings
- CVE-2022-43765DoS in APROLs Tbase serverB&R Industrial Automation B&R APROL
- CVE-2022-43763Lack of checking preconditions in APROL B&R Industrial Automation B&R APROL
- CVE-2022-43762Memory leak when receiving messages in APROL Tbase serverB&R Industrial Automation B&R APROL
- CVE-2022-38777An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate thElastic Endpoint Security
- CVE-2022-47648An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorizatBosch B420
- CVE-2023-0739Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-0740Cross-site Scripting (XSS) - Stored in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-0741Cross-site Scripting (XSS) - DOM in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-0742Cross-site Scripting (XSS) - Stored in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-0743Cross-site Scripting (XSS) - Generic in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-25396Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate
Medium, low and unrated 38
- CVE-2023-25163Argo CD leaks repository credentials in user-facing error messages and in logsargoproj argo-cd · github.com/argoproj/argo-cd/v2
- CVE-2023-25167Regular expression denial of service via installing themes via git in discoursediscourse
- CVE-2022-42436IBM MQ information disclosureIBM MQ
- CVE-2023-25166Regular Expression Denial of Service (ReDoS) Vulnerabilityhapijs formula · @sideway/formula
- CVE-2022-45091Cross-site Scripting in Smartpower WebGroup Arge Energy and Control Systems Smartpower Web
- CVE-2023-0751GELI silently omits the keyfile if read from stdinFreeBSD
- CVE-2023-25150Document content of files can be obtained through Collabora for files of other usersnextcloud security-advisories
- CVE-2022-34350IBM API Connect security bypassIBM API Connect
- CVE-2023-25165getHostByName Function Information Disclosurehelm · helm.sh/helm/v3
- CVE-2022-4304Timing Oracle in RSA DecryptionOpenSSL · openssl-src
- CVE-2022-43869IBM Spectrum Scale denial of serviceIBM Elastic Storage System · IBM Spectrum Scale
- CVE-2022-45087Cross-site Scripting in Smartpower WebGroup Arge Energy and Control Systems Smartpower Web
- CVE-2022-34362IBM Sterling Secure Proxy HOST header injectionIBM Sterling Secure Proxy
- CVE-2023-0690Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service ConfiguredHashiCorp Boundary · github.com/hashicorp/boundary
- CVE-2022-45086Cross-site Scripting in Smartpower WebGroup Arge Energy and Control Systems Smartpower Web
- CVE-2022-35720IBM Sterling External Authentication Server information disclosureIBM Sterling External Authentication Server · IBM Sterling…
- CVE-2023-23475IBM Infosphere Information Server cross-site scriptingIBM Infosphere Information Server
- CVE-2023-0003Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR ServerPalo Alto Networks Cortex XSOAR
- CVE-2023-0002Cortex XDR Agent: Product Disruption by Local Windows UserPalo Alto Networks Cortex XDR agent
- CVE-2023-0001Cortex XDR Agent: Cleartext Exposure of Agent Admin PasswordPalo Alto Networks Cortex XDR agent
- CVE-2022-45085Server-Side Request Forgery in Smartpower WebGroup Arge Energy and Control Systems Smartpower Web
- CVE-2022-41620WordPress SeoSamba for WordPress Webmasters Plugin <= 1.0.5 is vulnerable to Cross Site Request Forgery (CSRF)SeoSamba for WordPress Webmasters
- CVE-2022-2094Yellow Yard Searchbar < 2.8.2 - Reflected Cross-Site ScriptingYellow Yard Searchbar
- CVE-2023-0726Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_edit_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0722Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_save_statewickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0684Wicked Folders <= 2.18.16 - Missing Authorization via ajax_unassign_folderswickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0715Wicked Folders <= 2.18.16 - Missing Authorization on ajax_clone_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0711Wicked Folders <= 2.18.16 - Missing Authorization via ajax_save_statewickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0717Wicked Folders <= 2.18.16 - Missing Authorization via ajax_delete_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0725Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_clone_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0724Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_add_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0685Wicked Folders <= 2.18.16 - Cross-Site Request Forgery via ajax_unassign_folderswickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0720Wicked Folders <= 2.18.16 - Missing Authorization on ajax_save_folder_orderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2023-0716Wicked Folders <= 2.18.16 - Missing Authorization on ajax_edit_folderwickedplugins Wicked Folders – Folder Organizer for Pages,…
- CVE-2022-38778A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a requElastic kibana
- CVE-2022-45755Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the b
- CVE-2023-0747Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverbtcpayserver/btcpayserver
- CVE-2023-0748Open Redirect in btcpayserver/btcpayserverbtcpayserver/btcpayserver