# CVEs published 2023-02-08

72 CVEs were published on February 8, 2023: 8 critical, 26 high. Days are UTC.

- [CVE-2023-25168](https://cve.now/CVE-2023-25168.md): Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings (CVSS 9.6, pterodactyl wings · github.com/pterodactyl/wings)
- [CVE-2023-0251](https://cve.now/CVE-2023-0251.md): CVE-2023-0251 (CVSS 7.8, Delta Electronics DIAScreen)
- [CVE-2023-0250](https://cve.now/CVE-2023-0250.md): CVE-2023-0250 (CVSS 7.8, Delta Electronics DIAScreen)
- [CVE-2023-0249](https://cve.now/CVE-2023-0249.md): CVE-2023-0249 (CVSS 7.8, Delta Electronics DIAScreen)
- [CVE-2023-25163](https://cve.now/CVE-2023-25163.md): Argo CD leaks repository credentials in user-facing error messages and in logs (CVSS 6.3, argoproj argo-cd · github.com/argoproj/argo-cd/v2)
- [CVE-2023-25167](https://cve.now/CVE-2023-25167.md): Regular expression denial of service via installing themes via git in discourse (CVSS 6.5, discourse)
- [CVE-2022-42436](https://cve.now/CVE-2022-42436.md): IBM MQ information disclosure (CVSS 4.0, IBM MQ)
- [CVE-2023-25166](https://cve.now/CVE-2023-25166.md): Regular Expression Denial of Service (ReDoS) Vulnerability (CVSS 5.5, hapijs formula · @sideway/formula)
- [CVE-2022-45091](https://cve.now/CVE-2022-45091.md): Cross-site Scripting in Smartpower Web (CVSS 5.4, Group Arge Energy and Control Systems Smartpower Web)
- [CVE-2023-25164](https://cve.now/CVE-2023-25164.md): Sensitive Information leak via Script File in TinaCMS (CVSS 8.6, tinacms · @tinacms/cli)
- [CVE-2023-0751](https://cve.now/CVE-2023-0751.md): GELI silently omits the keyfile if read from stdin (CVSS 6.5, FreeBSD)
- [CVE-2023-25151](https://cve.now/CVE-2023-25151.md): DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib (CVSS 7.5, open-telemetry opentelemetry-go-contrib · go.opentelemet… +1)
- [CVE-2022-45090](https://cve.now/CVE-2022-45090.md): SQL Injection in Smartpower Web (CVSS 8.8, Group Arge Energy and Control Systems Smartpower Web)
- [CVE-2022-45089](https://cve.now/CVE-2022-45089.md): SQL Injection in Smartpower Web (CVSS 8.8, Group Arge Energy and Control Systems Smartpower Web)
- [CVE-2023-25150](https://cve.now/CVE-2023-25150.md): Document content of files can be obtained through Collabora for files of other users (CVSS 5.8, nextcloud security-advisories)
- [CVE-2022-34350](https://cve.now/CVE-2022-34350.md): IBM API Connect security bypass (CVSS 5.3, IBM API Connect)
- [CVE-2023-25165](https://cve.now/CVE-2023-25165.md): getHostByName Function Information Disclosure (CVSS 4.3, helm · helm.sh/helm/v3)
- [CVE-2022-4304](https://cve.now/CVE-2022-4304.md): Timing Oracle in RSA Decryption (CVSS 5.9, OpenSSL · openssl-src)
- [CVE-2022-4450](https://cve.now/CVE-2022-4450.md): Double free after calling PEM\_read\_bio\_ex (CVSS 7.5, OpenSSL · openssl-src)
- [CVE-2023-0215](https://cve.now/CVE-2023-0215.md): Use-after-free following BIO\_new\_NDEF (CVSS 7.5, OpenSSL · openssl-src)
- [CVE-2023-0216](https://cve.now/CVE-2023-0216.md): Invalid pointer dereference in d2i\_PKCS7 functions (CVSS 7.5, OpenSSL · openssl-src)
- [CVE-2023-0217](https://cve.now/CVE-2023-0217.md): NULL dereference validating DSA public key (CVSS 7.5, OpenSSL · openssl-src)
- [CVE-2023-0286](https://cve.now/CVE-2023-0286.md): X.400 address type confusion in X.509 GeneralName (CVSS 7.4, OpenSSL · cryptography +1)
- [CVE-2023-0401](https://cve.now/CVE-2023-0401.md): NULL dereference during PKCS7 data verification (CVSS 7.5, OpenSSL · openssl-src)
- [CVE-2022-42438](https://cve.now/CVE-2022-42438.md): IBM Cloud Pak for Multicloud Management Monitoring privilege escalation (CVSS 7.5, IBM Cloud Pak for Multicloud Management Monitoring)
- [CVE-2023-25152](https://cve.now/CVE-2023-25152.md): Symbolic Link (Symlink) Following in github.com/pterodactyl/wings (CVSS 8.4, pterodactyl wings · github.com/pterodactyl/wings)
- [CVE-2022-45088](https://cve.now/CVE-2022-45088.md): Local File Inclusion in Smartpower Web (CVSS 9.8, Group Arge Energy and Control Systems Smartpower Web)
- [CVE-2022-43869](https://cve.now/CVE-2022-43869.md): IBM Spectrum Scale denial of service (CVSS 6.5, IBM Elastic Storage System · IBM Spectrum Scale)
- [CVE-2022-45087](https://cve.now/CVE-2022-45087.md): Cross-site Scripting in Smartpower Web (CVSS 6.1, Group Arge Energy and Control Systems Smartpower Web)
- [CVE-2022-34362](https://cve.now/CVE-2022-34362.md): IBM Sterling Secure Proxy HOST header injection (CVSS 4.6, IBM Sterling Secure Proxy)
- [CVE-2023-0690](https://cve.now/CVE-2023-0690.md): Boundary Workers Store Rotated Credentials in Plaintext Even When a Key Management Service Configured (CVSS 5.0, HashiCorp Boundary · github.com/hashicorp/boundary)
- [CVE-2022-45086](https://cve.now/CVE-2022-45086.md): Cross-site Scripting in Smartpower Web (CVSS 5.4, Group Arge Energy and Control Systems Smartpower Web)
- [CVE-2022-35720](https://cve.now/CVE-2022-35720.md): IBM Sterling External Authentication Server information disclosure (CVSS 2.3, IBM Sterling External Authentication Server · IBM Sterling…)
- [CVE-2023-23475](https://cve.now/CVE-2023-23475.md): IBM Infosphere Information Server cross-site scripting (CVSS 4.6, IBM Infosphere Information Server)
- [CVE-2023-0003](https://cve.now/CVE-2023-0003.md): Cortex XSOAR: Local File Disclosure Vulnerability in the Cortex XSOAR Server (CVSS 6.5, Palo Alto Networks Cortex XSOAR)
- [CVE-2023-0002](https://cve.now/CVE-2023-0002.md): Cortex XDR Agent: Product Disruption by Local Windows User (CVSS 5.5, Palo Alto Networks Cortex XDR agent)
- [CVE-2023-0001](https://cve.now/CVE-2023-0001.md): Cortex XDR Agent: Cleartext Exposure of Agent Admin Password (CVSS 6.0, Palo Alto Networks Cortex XDR agent)
- [CVE-2022-45085](https://cve.now/CVE-2022-45085.md): Server-Side Request Forgery in Smartpower Web (CVSS 6.5, Group Arge Energy and Control Systems Smartpower Web)
- [CVE-2022-41620](https://cve.now/CVE-2022-41620.md): WordPress SeoSamba for WordPress Webmasters Plugin \<= 1.0.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, SeoSamba for WordPress Webmasters)
- [CVE-2022-43765](https://cve.now/CVE-2022-43765.md): DoS in APROLs Tbase server (CVSS 7.5, B&R Industrial Automation B&R APROL)
- [CVE-2022-43764](https://cve.now/CVE-2022-43764.md): Buffer overflow when changing configuration on Tbase Server (CVSS 9.8, B&R Industrial Automation B&R APROL)
- [CVE-2022-43763](https://cve.now/CVE-2022-43763.md): Lack of checking preconditions in APROL (CVSS 7.5, B&R Industrial Automation B&R APROL)
- [CVE-2022-43762](https://cve.now/CVE-2022-43762.md): Memory leak when receiving messages in APROL Tbase server (CVSS 7.5, B&R Industrial Automation B&R APROL)
- [CVE-2022-43761](https://cve.now/CVE-2022-43761.md): Lack of authentication when managing APROL database (CVSS 9.4, B&R Industrial Automation B&R APROL)
- [CVE-2022-2094](https://cve.now/CVE-2022-2094.md): Yellow Yard Searchbar \< 2.8.2 - Reflected Cross-Site Scripting (CVSS 6.1, Yellow Yard Searchbar)
- [CVE-2023-0726](https://cve.now/CVE-2023-0726.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery via ajax\_edit\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0722](https://cve.now/CVE-2023-0722.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery via ajax\_save\_state (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0684](https://cve.now/CVE-2023-0684.md): Wicked Folders \<= 2.18.16 - Missing Authorization via ajax\_unassign\_folders (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0715](https://cve.now/CVE-2023-0715.md): Wicked Folders \<= 2.18.16 - Missing Authorization on ajax\_clone\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0711](https://cve.now/CVE-2023-0711.md): Wicked Folders \<= 2.18.16 - Missing Authorization via ajax\_save\_state (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0717](https://cve.now/CVE-2023-0717.md): Wicked Folders \<= 2.18.16 - Missing Authorization via ajax\_delete\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0725](https://cve.now/CVE-2023-0725.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery via ajax\_clone\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0724](https://cve.now/CVE-2023-0724.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery via ajax\_add\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0685](https://cve.now/CVE-2023-0685.md): Wicked Folders \<= 2.18.16 - Cross-Site Request Forgery via ajax\_unassign\_folders (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0720](https://cve.now/CVE-2023-0720.md): Wicked Folders \<= 2.18.16 - Missing Authorization on ajax\_save\_folder\_order (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2023-0716](https://cve.now/CVE-2023-0716.md): Wicked Folders \<= 2.18.16 - Missing Authorization on ajax\_edit\_folder (CVSS 5.4, wickedplugins Wicked Folders – Folder Organizer for Pages,…)
- [CVE-2022-38777](https://cve.now/CVE-2022-38777.md): An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate th (CVSS 7.8, Elastic Endpoint Security)
- [CVE-2022-38778](https://cve.now/CVE-2022-38778.md): A flaw (CVE-2022-38900) was discovered in one of Kibana’s third party dependencies, that could allow an authenticated user to perform a requ (CVSS 6.5, Elastic kibana)
- [CVE-2022-45526](https://cve.now/CVE-2022-45526.md): SQL Injection vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows attackers to execute arbitrary commands via t (CVSS 9.8)
- [CVE-2022-45527](https://cve.now/CVE-2022-45527.md): File upload vulnerability in Future-Depth Institutional Management Website (IMS) 1.0, allows unauthorized attackers to directly upload malic (CVSS 9.8)
- [CVE-2022-45755](https://cve.now/CVE-2022-45755.md): Cross-site scripting (XSS) vulnerability in EyouCMS v1.6.0 allows attackers to execute arbitrary code via the home page description on the b (CVSS 5.4)
- [CVE-2022-45982](https://cve.now/CVE-2022-45982.md): thinkphp 6.0.0~6.0.13 and 6.1.0~6.1.1 contains a deserialization vulnerability. (CVSS 9.8, topthink/think)
- [CVE-2022-47648](https://cve.now/CVE-2022-47648.md): An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorizat (CVSS 7.6, Bosch B420)
- [CVE-2023-0739](https://cve.now/CVE-2023-0739.md): Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in answerdev/answer (CVSS 8.1, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-0740](https://cve.now/CVE-2023-0740.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 8.2, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-0741](https://cve.now/CVE-2023-0741.md): Cross-site Scripting (XSS) - DOM in answerdev/answer (CVSS 8.0, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-0742](https://cve.now/CVE-2023-0742.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 8.0, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-0743](https://cve.now/CVE-2023-0743.md): Cross-site Scripting (XSS) - Generic in answerdev/answer (CVSS 8.2, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-0744](https://cve.now/CVE-2023-0744.md): Improper Access Control in answerdev/answer (CVSS 9.8, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-0747](https://cve.now/CVE-2023-0747.md): Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver (CVSS 5.5, btcpayserver/btcpayserver)
- [CVE-2023-0748](https://cve.now/CVE-2023-0748.md): Open Redirect in btcpayserver/btcpayserver (CVSS 6.4, btcpayserver/btcpayserver)
- [CVE-2023-25396](https://cve.now/CVE-2023-25396.md): Privilege escalation in the MSI repair functionality in Caphyon Advanced Installer 20.0 and below allows attackers to access and manipulate (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.