CVEs published February 9, 2023
119 CVEs were published on February 9, 2023: 7 critical, 51 high.
- Published
- 119
- Critical
- 7
- High
- 51
- Medium
- 49
- Low
- 4
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 51
Most affected products
- Qualcomm Snapdragon
- 27
- Samsung Mobile Devices
- 19
- Huawei HarmonyOS · Huawei EMUI
- 15
- https://github.com/rack/rack · rack
- 3
- https://github.com/rails/rails · actionpack
- 3
- gpac/gpac
- 2
- https://github.com/rails/rails · activerecord
- 2
- Johnson Controls System Configuration Tool
- 2
- Samsung Mobile Galaxy Store
- 2
- Samsung Mobile Samsung Cloud
- 2
Critical 7
- CVE-2022-4557SQL Injection in Smartpower WebGroup Arge Energy and Control Systems Smartpower Web
- CVE-2022-40514Buffer copy without checking size of input in WLAN FirmwareQualcomm Snapdragon
- CVE-2022-33279Stack based buffer overflow in WLANQualcomm Snapdragon
- CVE-2022-33232Buffer copy without checking size of input in HypervisorQualcomm Snapdragon
- CVE-2022-25729Improper Input Validation in MODEMQualcomm Snapdragon
- CVE-2022-43550A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows https://github.com/jitsi
- CVE-2022-48290The phone-PC collaboration module has a logic bypass vulnerability.Huawei HarmonyOS
High 51
- CVE-2022-3568ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserializationrickardw ImageMagick Engine
- CVE-2022-21940Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT)Johnson Controls System Configuration Tool
- CVE-2022-21939Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT)Johnson Controls System Configuration Tool
- CVE-2023-0575Remote Code ExecutionYugabyteDB
- CVE-2022-43440Privilege escalation via manipulated unixcat executableTribe29 Checkmk
- CVE-2022-40513Uncontrolled resource consumption in WLAN Firmware.Qualcomm Snapdragon
- CVE-2022-40512Buffer over-read in WLAN Firmware.Qualcomm Snapdragon
- CVE-2022-40502Improper input validation in WLAN HostQualcomm Snapdragon
- CVE-2022-34146Improper input validation in WLAN HostQualcomm Snapdragon
- CVE-2022-34145Buffer over-read in WLAN HostQualcomm Snapdragon
- CVE-2022-33306Buffer over-read in WLANQualcomm Snapdragon
- CVE-2022-33280Access of uninitialized pointer in Bluetooth HOSTQualcomm Snapdragon
- CVE-2022-33277Buffer copy without checking size of input in modemQualcomm Snapdragon
- CVE-2022-33271Buffer over-read in WLANQualcomm Snapdragon
- CVE-2022-33248Integer overflow to buffer overflow in User Identity ModuleQualcomm Snapdragon
- CVE-2022-33243Improper access control in Qualcomm IPCQualcomm Snapdragon
- CVE-2022-33233Configuration weakness in modemQualcomm Snapdragon
- CVE-2022-33229Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-25738Buffer Over-read in MODEMQualcomm Snapdragon
- CVE-2022-25735Null Pointer Dereference in MODEMQualcomm Snapdragon
- CVE-2022-25734Loop with Unreachable Exit Condition in MODEMQualcomm Snapdragon
- CVE-2022-25733Null Pointer Dereference in MODEMQualcomm Snapdragon
- CVE-2022-25732Buffer Over-read in MODEMQualcomm Snapdragon
- CVE-2022-25728Buffer Over-read in MODEMQualcomm Snapdragon
- CVE-2022-44566A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1.https://github.com/rails/rails · activerecord
- CVE-2022-48286The multi-screen collaboration module has a privilege escalation vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48287The HwContacts module has a logic bypass vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48288The bundle management module lacks authentication and control mechanisms in some APIs.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48289The bundle management module lacks authentication and control mechanisms in some APIs.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48294The IHwAttestationService interface has a defect in authentication.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48295The IHwAntiMalPlugin interface lacks permission verification.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48297The geofencing kernel code has a vulnerability of not verifying the length of the input data.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48298The geofencing kernel code does not verify the length of the input data.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48299The WMS module lacks the authentication mechanism in some APIs.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48300The WMS module lacks the authentication mechanism in some APIs.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48301The bundle management module lacks permission verification in some APIs.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48302The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data Huawei HarmonyOS · Huawei EMUI
- CVE-2023-0760Heap-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-0770Stack-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-21420Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution.Samsung Mobile Devices
- CVE-2023-21433Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy SSamsung Mobile Galaxy Store
- CVE-2023-21439Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to launch certain activitieSamsung Mobile Devices
- CVE-2023-21441Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R(Samsung Mobile Routine
- CVE-2023-21443Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted mesSamsung Mobile Samsung Flow for Android
- CVE-2023-21444Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject commSamsung Mobile Samsung Flow for PC
- CVE-2023-22792A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1.https://github.com/rails/rails · actionpack
- CVE-2023-23592WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information.
- CVE-2023-23912A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with tUbiquiti EdgeRouter(s) and USG
- CVE-2023-24323Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability.
- CVE-2023-24684ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php.
- CVE-2023-24685ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance report
Medium, low and unrated 61
- CVE-2015-10076dimtion Shaarlier Tag TagsSource.java createTag sql injectiondimtion Shaarlier
- CVE-2023-23625Denial of service in HAMT Decoding in go-unixfs ipfs go-unixfs · github.com/ipfs/go-unixfs
- CVE-2023-23626Denial of service when feeding malformed size arguments in go-bitfieldipfs go-bitfield · github.com/ipfs/go-bitfield
- CVE-2023-23631HAMT Decoding Panics in github.com/ipfs/go-unixfsnodeipfs go-unixfsnode · github.com/ipfs/go-unixfsnode
- CVE-2023-24815Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-webvert-x3 vertx-web · io.vertx:vertx-web
- CVE-2023-0745Arbitrary File Write in High Availability Backup UploadYugabyteDB Anywhere
- CVE-2023-0574Server-Side Request ForgeryYugabyteDB Anywhere
- CVE-2023-0758glorylion JFinalOA SysOrg.java sql injectionglorylion JFinalOA
- CVE-2022-33246Use of out-of-range pointer offset in AudioQualcomm Snapdragon
- CVE-2022-33225Use after free in Trusted Application EnvironmentQualcomm Snapdragon
- CVE-2022-33221Buffer over-read in Trusted Execution EnvironmentQualcomm Snapdragon
- CVE-2022-33216Improper Input Validation in AutomotiveQualcomm Snapdragon
- CVE-2022-30564Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp.IPC-HX5XXX,IPC-HX7XXX,SD5A,SD22,SD59,NVR5XXX-I,NVR5XXX-I/L,…
- CVE-2022-43552A use after free vulnerability exists in curl <7.87.0.https://github.com/curl/curl
- CVE-2022-44570A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0.https://github.com/rack/rack · rack
- CVE-2022-44571There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1.https://github.com/rack/rack · rack
- CVE-2022-44572A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an ahttps://github.com/rack/rack · rack
- CVE-2022-48292The Bluetooth module has an out-of-memory (OOM) vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48293The Bluetooth module has an OOM vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48296The SystemUI has a vulnerability in permission management.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-0624OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application.OrangeScrum
- CVE-2023-0759Privilege Chaining in cockpit-hq/cockpitcockpit-hq/cockpit
- CVE-2023-21419An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under cSamsung Mobile Devices
- CVE-2023-21421Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allowsSamsung Mobile Devices
- CVE-2023-21422Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNSSamsung Mobile Devices
- CVE-2023-21423Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without pSamsung Mobile Devices
- CVE-2023-21424Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attacSamsung Mobile Devices
- CVE-2023-21425Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive informaSamsung Mobile Devices
- CVE-2023-21426Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN.Samsung Mobile Devices
- CVE-2023-21427Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without user recognition.Samsung Mobile Devices
- CVE-2023-21428Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call.Samsung Mobile Devices
- CVE-2023-21429Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID.Samsung Mobile Devices
- CVE-2023-21430An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 ReleaseSamsung Mobile Devices
- CVE-2023-21431Improper input validation in Bixby Vision prior to version 3.7.70.17 allows attacker to access data of Bixby Vision.Samsung Mobile Bixby Vision
- CVE-2023-21432Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the ownSamsung Mobile Smart Things
- CVE-2023-21434Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching Samsung Mobile Galaxy Store
- CVE-2023-21435Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory addrSamsung Mobile Devices
- CVE-2023-21436Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID.Samsung Mobile Devices
- CVE-2023-21437Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive informSamsung Mobile Devices
- CVE-2023-21438Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder.Samsung Mobile Devices
- CVE-2023-21440Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture.Samsung Mobile Devices
- CVE-2023-21442Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) Samsung Mobile Runestone
- CVE-2023-21445Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(12) and 14.1.00.422 inSamsung Mobile The patch adds proper access control to use…
- CVE-2023-21446Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(1Samsung Mobile MyFiles
- CVE-2023-21447Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with SamsungSamsung Mobile Samsung Cloud
- CVE-2023-21448Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file.Samsung Mobile Samsung Cloud
- CVE-2023-21450Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner's widget without Samsung Mobile One Hand Operation +
- CVE-2023-21451A Stack-based overflow vulnerability in IpcRxEmbmsSessionList in SECRIL prior to Android S(12) allows attacker to cause memory corruptions.Samsung Mobile Devices
- CVE-2023-22794A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments.https://github.com/rails/rails · activerecord
- CVE-2023-22795A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header.https://github.com/rails/rails · actionpack
- CVE-2023-22796A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1.https://github.com/rails/rails · activesupport
- CVE-2023-22797An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrushttps://github.com/rails/rails · actionpack
- CVE-2023-22798Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websihttps://github.com/brave/adblock-lists
- CVE-2023-22799A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regulhttps://github.com/rails/globalid · globalid
- CVE-2023-22953In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user.
- CVE-2023-24322A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arb
- CVE-2023-24686An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV fil
- CVE-2023-24687Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings component.
- CVE-2023-24688An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is di
- CVE-2023-24689An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via m
- CVE-2023-24690ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family.