# CVEs published 2023-02-09

119 CVEs were published on February 9, 2023: 7 critical, 51 high. Days are UTC.

- [CVE-2022-3568](https://cve.now/CVE-2022-3568.md): ImageMagick Engine \<= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization (CVSS 8.8, rickardw ImageMagick Engine)
- [CVE-2015-10076](https://cve.now/CVE-2015-10076.md): dimtion Shaarlier Tag TagsSource.java createTag sql injection (CVSS 5.5, dimtion Shaarlier)
- [CVE-2023-23625](https://cve.now/CVE-2023-23625.md): Denial of service in HAMT Decoding in go-unixfs (CVSS 5.9, ipfs go-unixfs · github.com/ipfs/go-unixfs)
- [CVE-2023-23626](https://cve.now/CVE-2023-23626.md): Denial of service when feeding malformed size arguments in go-bitfield (CVSS 5.9, ipfs go-bitfield · github.com/ipfs/go-bitfield)
- [CVE-2022-21940](https://cve.now/CVE-2022-21940.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in System Configuration Tool (SCT) (CVSS 7.5, Johnson Controls System Configuration Tool)
- [CVE-2022-21939](https://cve.now/CVE-2022-21939.md): Sensitive cookie without 'HttpOnly' flag in System Configuration Tool (SCT) (CVSS 7.5, Johnson Controls System Configuration Tool)
- [CVE-2023-23631](https://cve.now/CVE-2023-23631.md): HAMT Decoding Panics in github.com/ipfs/go-unixfsnode (CVSS 5.9, ipfs go-unixfsnode · github.com/ipfs/go-unixfsnode)
- [CVE-2023-24815](https://cve.now/CVE-2023-24815.md): Disclosure of classpath resources on Windows when mounted on a wildcard route in vertx-web (CVSS 4.8, vert-x3 vertx-web · io.vertx:vertx-web)
- [CVE-2023-0575](https://cve.now/CVE-2023-0575.md): Remote Code Execution (CVSS 7.2, YugabyteDB)
- [CVE-2023-0745](https://cve.now/CVE-2023-0745.md): Arbitrary File Write in High Availability Backup Upload (CVSS 6.7, YugabyteDB Anywhere)
- [CVE-2023-0574](https://cve.now/CVE-2023-0574.md): Server-Side Request Forgery (CVSS 6.8, YugabyteDB Anywhere)
- [CVE-2023-0758](https://cve.now/CVE-2023-0758.md): glorylion JFinalOA SysOrg.java sql injection (CVSS 6.3, glorylion JFinalOA)
- [CVE-2022-4557](https://cve.now/CVE-2022-4557.md): SQL Injection in Smartpower Web (CVSS 9.8, Group Arge Energy and Control Systems Smartpower Web)
- [CVE-2022-43440](https://cve.now/CVE-2022-43440.md): Privilege escalation via manipulated unixcat executable (CVSS 8.8, Tribe29 Checkmk)
- [CVE-2022-40514](https://cve.now/CVE-2022-40514.md): Buffer copy without checking size of input in WLAN Firmware (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-40513](https://cve.now/CVE-2022-40513.md): Uncontrolled resource consumption in WLAN Firmware. (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-40512](https://cve.now/CVE-2022-40512.md): Buffer over-read in WLAN Firmware. (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-40502](https://cve.now/CVE-2022-40502.md): Improper input validation in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-34146](https://cve.now/CVE-2022-34146.md): Improper input validation in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-34145](https://cve.now/CVE-2022-34145.md): Buffer over-read in WLAN Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33306](https://cve.now/CVE-2022-33306.md): Buffer over-read in WLAN (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33280](https://cve.now/CVE-2022-33280.md): Access of uninitialized pointer in Bluetooth HOST (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2022-33279](https://cve.now/CVE-2022-33279.md): Stack based buffer overflow in WLAN (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-33277](https://cve.now/CVE-2022-33277.md): Buffer copy without checking size of input in modem (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33271](https://cve.now/CVE-2022-33271.md): Buffer over-read in WLAN (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33248](https://cve.now/CVE-2022-33248.md): Integer overflow to buffer overflow in User Identity Module (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2022-33246](https://cve.now/CVE-2022-33246.md): Use of out-of-range pointer offset in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33243](https://cve.now/CVE-2022-33243.md): Improper access control in Qualcomm IPC (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33233](https://cve.now/CVE-2022-33233.md): Configuration weakness in modem (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2022-33232](https://cve.now/CVE-2022-33232.md): Buffer copy without checking size of input in Hypervisor (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2022-33229](https://cve.now/CVE-2022-33229.md): Buffer over-read in Modem (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33225](https://cve.now/CVE-2022-33225.md): Use after free in Trusted Application Environment (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33221](https://cve.now/CVE-2022-33221.md): Buffer over-read in Trusted Execution Environment (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2022-33216](https://cve.now/CVE-2022-33216.md): Improper Input Validation in Automotive (CVSS 6.0, Qualcomm Snapdragon)
- [CVE-2022-25738](https://cve.now/CVE-2022-25738.md): Buffer Over-read in MODEM (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-25735](https://cve.now/CVE-2022-25735.md): Null Pointer Dereference in MODEM (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-25734](https://cve.now/CVE-2022-25734.md): Loop with Unreachable Exit Condition in MODEM (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-25733](https://cve.now/CVE-2022-25733.md): Null Pointer Dereference in MODEM (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-25732](https://cve.now/CVE-2022-25732.md): Buffer Over-read in MODEM (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-25729](https://cve.now/CVE-2022-25729.md): Improper Input Validation in MODEM (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-25728](https://cve.now/CVE-2022-25728.md): Buffer Over-read in MODEM (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-30564](https://cve.now/CVE-2022-30564.md): Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. (CVSS 5.3, IPC-HX5XXX,IPC-HX7XXX,SD5A,SD22,SD59,NVR5XXX-I,NVR5XXX-I/L,…)
- [CVE-2022-43550](https://cve.now/CVE-2022-43550.md): A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows (CVSS 9.8, https://github.com/jitsi)
- [CVE-2022-43552](https://cve.now/CVE-2022-43552.md): A use after free vulnerability exists in curl \<7.87.0. (CVSS 5.9, https://github.com/curl/curl)
- [CVE-2022-44566](https://cve.now/CVE-2022-44566.md): A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter \<7.0.4.1 and \<6.1.7.1. (CVSS 7.5, https://github.com/rails/rails · activerecord)
- [CVE-2022-44570](https://cve.now/CVE-2022-44570.md): A denial of service vulnerability in the Range header parsing component of Rack \>= 1.5.0. (no CVSS, https://github.com/rack/rack · rack)
- [CVE-2022-44571](https://cve.now/CVE-2022-44571.md): There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. (no CVSS, https://github.com/rack/rack · rack)
- [CVE-2022-44572](https://cve.now/CVE-2022-44572.md): A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an a (no CVSS, https://github.com/rack/rack · rack)
- [CVE-2022-48286](https://cve.now/CVE-2022-48286.md): The multi-screen collaboration module has a privilege escalation vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48287](https://cve.now/CVE-2022-48287.md): The HwContacts module has a logic bypass vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48288](https://cve.now/CVE-2022-48288.md): The bundle management module lacks authentication and control mechanisms in some APIs. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48289](https://cve.now/CVE-2022-48289.md): The bundle management module lacks authentication and control mechanisms in some APIs. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48290](https://cve.now/CVE-2022-48290.md): The phone-PC collaboration module has a logic bypass vulnerability. (CVSS 9.1, Huawei HarmonyOS)
- [CVE-2022-48292](https://cve.now/CVE-2022-48292.md): The Bluetooth module has an out-of-memory (OOM) vulnerability. (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48293](https://cve.now/CVE-2022-48293.md): The Bluetooth module has an OOM vulnerability. (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48294](https://cve.now/CVE-2022-48294.md): The IHwAttestationService interface has a defect in authentication. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48295](https://cve.now/CVE-2022-48295.md): The IHwAntiMalPlugin interface lacks permission verification. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48296](https://cve.now/CVE-2022-48296.md): The SystemUI has a vulnerability in permission management. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48297](https://cve.now/CVE-2022-48297.md): The geofencing kernel code has a vulnerability of not verifying the length of the input data. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48298](https://cve.now/CVE-2022-48298.md): The geofencing kernel code does not verify the length of the input data. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48299](https://cve.now/CVE-2022-48299.md): The WMS module lacks the authentication mechanism in some APIs. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48300](https://cve.now/CVE-2022-48300.md): The WMS module lacks the authentication mechanism in some APIs. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48301](https://cve.now/CVE-2022-48301.md): The bundle management module lacks permission verification in some APIs. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48302](https://cve.now/CVE-2022-48302.md): The AMS module has a vulnerability of lacking permission verification in APIs.Successful exploitation of this vulnerability may affect data (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-0624](https://cve.now/CVE-2023-0624.md): OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. (CVSS 6.1, OrangeScrum)
- [CVE-2023-0759](https://cve.now/CVE-2023-0759.md): Privilege Chaining in cockpit-hq/cockpit (CVSS 5.3, cockpit-hq/cockpit)
- [CVE-2023-0760](https://cve.now/CVE-2023-0760.md): Heap-based Buffer Overflow in gpac/gpac (CVSS 7.3, gpac/gpac)
- [CVE-2023-0770](https://cve.now/CVE-2023-0770.md): Stack-based Buffer Overflow in gpac/gpac (CVSS 7.8, gpac/gpac)
- [CVE-2023-21419](https://cve.now/CVE-2023-21419.md): An improper implementation logic in Secure Folder prior to SMR Jan-2023 Release 1 allows the Secure Folder container remain unlocked under c (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-21420](https://cve.now/CVE-2023-21420.md): Use of Externally-Controlled Format String vulnerabilities in STST TA prior to SMR Jan-2023 Release 1 allows arbitrary code execution. (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2023-21421](https://cve.now/CVE-2023-21421.md): Improper Handling of Insufficient Permissions or Privileges vulnerability in KnoxCustomManagerService prior to SMR Jan-2023 Release 1 allows (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2023-21422](https://cve.now/CVE-2023-21422.md): Improper authorization vulnerability in semAddPublicDnsAddr in WifiSevice prior to SMR Jan-2023 Release 1 allows attackers to set custom DNS (CVSS 5.7, Samsung Mobile Devices)
- [CVE-2023-21423](https://cve.now/CVE-2023-21423.md): Improper authorization vulnerability in ChnFileShareKit prior to SMR Jan-2023 Release 1 allows attacker to control BLE advertising without p (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2023-21424](https://cve.now/CVE-2023-21424.md): Improper Handling of Insufficient Permissions or Privileges vulnerability in SemChameleonHelper prior to SMR Jan-2023 Release 1 allows attac (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2023-21425](https://cve.now/CVE-2023-21425.md): Improper access control vulnerability in telecom application prior to SMR JAN-2023 Release 1 allows local attackers to get sensitive informa (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-21426](https://cve.now/CVE-2023-21426.md): Hardcoded AES key to encrypt cardemulation PINs in NFC prior to SMR Jan-2023 Release 1 allows attackers to access cardemulation PIN. (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-21427](https://cve.now/CVE-2023-21427.md): Improper access control vulnerability in NfcTile prior to SMR Jan-2023 Release 1 allows to attacker to use NFC without user recognition. (CVSS 5.4, Samsung Mobile Devices)
- [CVE-2023-21428](https://cve.now/CVE-2023-21428.md): Improper input validation vulnerability in TelephonyUI prior to SMR Jan-2023 Release 1 allows attackers to configure Preferred Call. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21429](https://cve.now/CVE-2023-21429.md): Improper usage of implict intent in ePDG prior to SMR JAN-2023 Release 1 allows attacker to access SSID. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21430](https://cve.now/CVE-2023-21430.md): An out-of-bound read vulnerability in mapToBuffer function in libSDKRecognitionText.spensdk.samsung.so library prior to SMR JAN-2023 Release (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-21431](https://cve.now/CVE-2023-21431.md): Improper input validation in Bixby Vision prior to version 3.7.70.17 allows attacker to access data of Bixby Vision. (CVSS 3.3, Samsung Mobile Bixby Vision)
- [CVE-2023-21432](https://cve.now/CVE-2023-21432.md): Improper access control vulnerabilities in Smart Things prior to 1.7.93 allows to attacker to invite others without authorization of the own (CVSS 4.2, Samsung Mobile Smart Things)
- [CVE-2023-21433](https://cve.now/CVE-2023-21433.md): Improper access control vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to install applications from Galaxy S (CVSS 7.8, Samsung Mobile Galaxy Store)
- [CVE-2023-21434](https://cve.now/CVE-2023-21434.md): Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching (CVSS 6.2, Samsung Mobile Galaxy Store)
- [CVE-2023-21435](https://cve.now/CVE-2023-21435.md): Exposure of Sensitive Information vulnerability in Fingerprint TA prior to SMR Feb-2023 Release 1 allows attackers to access the memory addr (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-21436](https://cve.now/CVE-2023-21436.md): Improper usage of implicit intent in Contacts prior to SMR Feb-2023 Release 1 allows attacker to get account ID. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2023-21437](https://cve.now/CVE-2023-21437.md): Improper access control vulnerability in Phone application prior to SMR Feb-2023 Release 1 allows local attackers to access sensitive inform (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-21438](https://cve.now/CVE-2023-21438.md): Improper logic in HomeScreen prior to SMR Feb-2023 Release 1 allows physical attacker to access App preview protected by Secure Folder. (CVSS 2.1, Samsung Mobile Devices)
- [CVE-2023-21439](https://cve.now/CVE-2023-21439.md): Improper input validation vulnerability in UwbDataTxStatusEvent prior to SMR Feb-2023 Release 1 allows attackers to launch certain activitie (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-21440](https://cve.now/CVE-2023-21440.md): Improper access control vulnerability in WindowManagerService prior to SMR Feb-2023 Release 1 allows attackers to take a screen capture. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-21441](https://cve.now/CVE-2023-21441.md): Insufficient Verification of Data Authenticity vulnerability in Routine prior to versions 2.6.30.6 in Android Q(10), 3.1.21.10 in Android R( (CVSS 7.4, Samsung Mobile Routine)
- [CVE-2023-21442](https://cve.now/CVE-2023-21442.md): Improper access control vulnerability in Runestone application prior to version 2.9.09.003 in Android R(11) and 3.2.01.007 in Android S(12) (CVSS 4.0, Samsung Mobile Runestone)
- [CVE-2023-21443](https://cve.now/CVE-2023-21443.md): Improper cryptographic implementation in Samsung Flow for Android prior to version 4.9.04 allows adjacent attackers to decrypt encrypted mes (CVSS 7.5, Samsung Mobile Samsung Flow for Android)
- [CVE-2023-21444](https://cve.now/CVE-2023-21444.md): Improper cryptographic implementation in Samsung Flow for PC 4.9.14.0 allows adjacent attackers to decrypt encrypted messages or inject comm (CVSS 7.5, Samsung Mobile Samsung Flow for PC)
- [CVE-2023-21445](https://cve.now/CVE-2023-21445.md): Improper access control vulnerability in MyFiles prior to versions 12.2.09 in Android R(11), 13.1.03.501 in Android S(12) and 14.1.00.422 in (CVSS 5.5, Samsung Mobile The patch adds proper access control to use…)
- [CVE-2023-21446](https://cve.now/CVE-2023-21446.md): Improper input validation in MyFiles prior to version 12.2.09 in Android R(11), 13.1.03.501 in Android S( 12) and 14.1.00.422 in Android T(1 (CVSS 6.2, Samsung Mobile MyFiles)
- [CVE-2023-21447](https://cve.now/CVE-2023-21447.md): Improper access control vulnerabilities in Samsung Cloud prior to version 5.3.0.32 allows local attackers to access information with Samsung (CVSS 4.0, Samsung Mobile Samsung Cloud)
- [CVE-2023-21448](https://cve.now/CVE-2023-21448.md): Path traversal vulnerability in Samsung Cloud prior to version 5.3.0.32 allows attacker to access specific png file. (CVSS 5.7, Samsung Mobile Samsung Cloud)
- [CVE-2023-21450](https://cve.now/CVE-2023-21450.md): Missing Authorization vulnerability in One Hand Operation + prior to version 6.1.21 allows multi-users to access owner&#39;s widget without (CVSS 2.3, Samsung Mobile One Hand Operation +)
- [CVE-2023-21451](https://cve.now/CVE-2023-21451.md): A Stack-based overflow vulnerability in IpcRxEmbmsSessionList in SECRIL prior to Android S(12) allows attacker to cause memory corruptions. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-22792](https://cve.now/CVE-2023-22792.md): A regular expression based DoS vulnerability in Action Dispatch \<6.0.6.1,\< 6.1.7.1, and \<7.0.4.1. (CVSS 7.5, https://github.com/rails/rails · actionpack)
- [CVE-2023-22794](https://cve.now/CVE-2023-22794.md): A vulnerability in ActiveRecord \<6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. (no CVSS, https://github.com/rails/rails · activerecord)
- [CVE-2023-22795](https://cve.now/CVE-2023-22795.md): A regular expression based DoS vulnerability in Action Dispatch \<6.1.7.1 and \<7.0.4.1 related to the If-None-Match header. (no CVSS, https://github.com/rails/rails · actionpack)
- [CVE-2023-22796](https://cve.now/CVE-2023-22796.md): A regular expression based DoS vulnerability in Active Support \<6.1.7.1 and \<7.0.4.1. (no CVSS, https://github.com/rails/rails · activesupport)
- [CVE-2023-22797](https://cve.now/CVE-2023-22797.md): An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect\_to with untrus (CVSS 6.1, https://github.com/rails/rails · actionpack)
- [CVE-2023-22798](https://cve.now/CVE-2023-22798.md): Prior to commit 51867e0d15a6d7f80d5b714fd0e9976b9c160bb0, https://github.com/brave/adblock-lists removed redirect interceptors on some websi (CVSS 6.1, https://github.com/brave/adblock-lists)
- [CVE-2023-22799](https://cve.now/CVE-2023-22799.md): A ReDoS based DoS vulnerability in the GlobalID \<1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regul (no CVSS, https://github.com/rails/globalid · globalid)
- [CVE-2023-22953](https://cve.now/CVE-2023-22953.md): In ExpressionEngine before 7.2.6, remote code execution can be achieved by an authenticated Control Panel user. (no CVSS)
- [CVE-2023-23592](https://cve.now/CVE-2023-23592.md): WALLIX Access Manager 3.x through 4.0.x allows a remote attacker to access sensitive information. (CVSS 7.5)
- [CVE-2023-23912](https://cve.now/CVE-2023-23912.md): A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with t (CVSS 8.8, Ubiquiti EdgeRouter(s) and USG)
- [CVE-2023-24322](https://cve.now/CVE-2023-24322.md): A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arb (CVSS 6.1)
- [CVE-2023-24323](https://cve.now/CVE-2023-24323.md): Mojoportal v2.7 was discovered to contain an authenticated XML external entity (XXE) injection vulnerability. (CVSS 8.8)
- [CVE-2023-24684](https://cve.now/CVE-2023-24684.md): ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the EID parameter at GetText.php. (CVSS 7.2)
- [CVE-2023-24685](https://cve.now/CVE-2023-24685.md): ChurchCRM v4.5.3 and below was discovered to contain a SQL injection vulnerability via the Event parameter under the Event Attendance report (CVSS 7.2)
- [CVE-2023-24686](https://cve.now/CVE-2023-24686.md): An issue in the CSV Import function of ChurchCRM v4.5.3 and below allows attackers to execute arbitrary code via importing a crafted CSV fil (CVSS 4.8)
- [CVE-2023-24687](https://cve.now/CVE-2023-24687.md): Mojoportal v2.7.0.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Company Info Settings component. (CVSS 5.4)
- [CVE-2023-24688](https://cve.now/CVE-2023-24688.md): An issue in Mojoportal v2.7.0.0 allows an unauthenticated attacker to register a new user even if the Allow User Registrations feature is di (CVSS 5.3)
- [CVE-2023-24689](https://cve.now/CVE-2023-24689.md): An issue in Mojoportal v2.7.0.0 and below allows an authenticated attacker to list all css files inside the root path of the webserver via m (CVSS 4.3)
- [CVE-2023-24690](https://cve.now/CVE-2023-24690.md): ChurchCRM 4.5.3 and below was discovered to contain a stored cross-site scripting (XSS) vulnerability at /api/public/register/family. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.