CVEs published February 10, 2023
74 CVEs were published on February 10, 2023: 8 critical, 24 high.
- Published
- 74
- Critical
- 8
- High
- 24
- Medium
- 35
- Low
- 4
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Dell PowerPath Management Appliance
- 7
- datahub-project datahub
- 6
- Dell Wyse Management Suite
- 6
- Dell PowerScale OneFS
- 4
- Dell SupportAssist
- 4
- Dell SupportAssist Client Consumer
- 4
- ALEOS
- 2
- Dell PowerEdge Platform
- 2
- ampache/ampache
- 1
- Apache Software Foundation Apache NiFi · org.apache.nifi:ni…
- 1
Critical 8
- CVE-2022-43501KASAGO TCP/IP stack provided by Zuken Elmic generates ISNs(Initial Sequence Number) for TCP connections from an insufficiently random sourceZUKEN Elmic Kasago IPv6/v4 Dual · ZUKEN Elmic Kasago IPv4 +1
- CVE-2022-45699Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitr
- CVE-2022-45766Hardcoded credentials in Global Facilities Management Software (GFMS) Version 3 software distributed by Key Systems Management permits remot
- CVE-2023-24348D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetACLFilter.
- CVE-2023-24349D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetRoute.
- CVE-2023-24350D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the config.smtp_email_subject parameter at /goform
- CVE-2023-24351D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the FILECODE parameter at /goform/formLogin.
- CVE-2023-24352D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWPS.
High 24
- CVE-2023-25557Server-Side Request Forgery in DataHubdatahub-project datahub
- CVE-2023-25558Deserialization of untrusted data in DataHubdatahub-project datahub
- CVE-2023-25559System account impersonation in DataHubdatahub-project datahub
- CVE-2023-25560JSON Injection in DataHubdatahub-project datahub
- CVE-2023-0776Remote Code Execution in Baicells QRTB PlatformBaicells Nova · Baicells Neutrino
- CVE-2022-46754 Wyse Management Suite 3.8 and below contain an improper access control vulnerability.Dell Wyse Management Suite
- CVE-2022-45104 Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execution vulnerability.Dell Unisphere for PowerMax vApp
- CVE-2022-34448 PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Cross-site Request Forgery vulnerability.Dell PowerPath Management Appliance
- CVE-2022-34447 PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains OS Command Injection vulnerability.Dell PowerPath Management Appliance
- CVE-2022-34446 PowerPath Management Appliance with versions 3.3 & 3.2* contains Authorization Bypass vulnerability.Dell PowerPath Management Appliance
- CVE-2022-34388 Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain informatioDell SupportAssist
- CVE-2022-34384 Dell SupportAssist Client Consumer (version 3.11.1 and prior), SupportAssist Client Commercial (version 3.2 and prior), Dell Command | UpdaDell SupportAssist Client Consumer
- CVE-2022-33934 Dell PowerScale OneFS, versions 8.2.x through 9.4.x contain multiple stored cross-site scripting vulnerabilities.Dell PowerScale OneFS
- CVE-2023-24569 Dell Alienware Command Center versions 5.5.37.0 and prior contain an Improper Input validation vulnerability.Dell Alienware Command Center
- CVE-2023-0774SourceCodester Medical Certificate Generator App action.php sql injectionSourceCodester Medical Certificate Generator App
- CVE-2023-22832Apache NiFi: Improper Restriction of XML External Entity References in ExtractCCDAAttributesApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2022-46649Acemanager in ALEOS before version 4.16 allows a user with valid credentials to manipulate the IP logging operation to execute arbitrary sheALEOS
- CVE-2023-0771 SQL Injection in ampache/ampacheampache/ampache
- CVE-2023-0777Authentication Bypass by Primary Weakness in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-24343D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSchedule.
- CVE-2023-24344D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formWlanGuestSetu
- CVE-2023-24345D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the curTime parameter at /goform/formSetWanDhcpplu
- CVE-2023-24346D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the wan_connected parameter at /goform/formEasySet
- CVE-2023-24347D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplu
Medium, low and unrated 42
- CVE-2023-25561Login fail open on JAAS misconfiguration in DataHubdatahub-project datahub
- CVE-2023-25562Failure to Invalidate Session on Logout in DataHubdatahub-project datahub
- CVE-2022-46755 Wyse Management Suite 3.8 and below contain an improper access control vulnerability.Dell Wyse Management Suite
- CVE-2022-46677 Wyse Management Suite 3.8 and below contain an improper access control vulnerability with which an custom group admin can create a subgroupDell Wyse Management Suite
- CVE-2022-46678 Wyse Management Suite 3.8 and below contain an improper access control vulnerability.Dell Wyse Management Suite
- CVE-2022-46676 Wyse Management Suite 3.8 and below contain an improper access control vulnerability.Dell Wyse Management Suite
- CVE-2022-46675 Wyse Management Suite Repository 3.8 and below contain an information disclosure vulnerability.Dell Wyse Management Suite
- CVE-2022-34451 PowerPath Management Appliance with versions 3.3 & 3.2*, 3.1 & 3.0* contains a Stored Cross-site Scripting Vulnerability.Dell PowerPath Management Appliance
- CVE-2022-34450 PowerPath Management Appliance with version 3.3 contains Privilege Escalation vulnerability.Dell PowerPath Management Appliance
- CVE-2022-34449 PowerPath Management Appliance with versions 3.3 & 3.2* contains a Hardcoded Cryptographic Keys vulnerability.Dell PowerPath Management Appliance
- CVE-2022-34445 Dell PowerScale OneFS, versions 8.2.x through 9.3.x contain a weak encoding for a password.Dell PowerScale OneFS
- CVE-2022-34444 Dell PowerScale OneFS, versions 9.2.0.x through 9.4.0.x contain an information vulnerability.Dell PowerScale OneFS
- CVE-2022-34404 Dell System Update, version 2.0.0 and earlier, contains an Improper Certificate Validation in data parser module.Dell System Update
- CVE-2022-34392 SupportAssist for Home PCs (versions 3.11.4 and prior) contain an insufficient session expiration Vulnerability.Dell SupportAssist
- CVE-2022-34389 Dell SupportAssist contains a rate limit bypass issues in screenmeet API third party component.Dell SupportAssist
- CVE-2022-34387 Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain a privilDell SupportAssist
- CVE-2022-34386 Dell SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographDell SupportAssist Client Consumer
- CVE-2022-34385 SupportAssist for Home PCs (version 3.11.4 and prior) and SupportAssist for Business PCs (version 3.2.0 and prior) contain cryptographic wDell SupportAssist Client Consumer
- CVE-2022-34377 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2023-24816set_term_title command injection in ipythonipython
- CVE-2022-34376 Dell PowerEdge BIOS and Dell Precision BIOS contain an improper input validation vulnerability.Dell PowerEdge Platform
- CVE-2022-34366 Dell SupportAssist for Home PCs (version 3.11.2 and prior) contain Overly Permissive Cross-domain Whitelist vulnerability.Dell SupportAssist Client Consumer
- CVE-2022-34364 Dell BSAFE SSL-J, versions before 6.5 and version 7.0 contain a debug message revealing unnecessary information vulnerability.Dell BSAFE SSL-J
- CVE-2022-4903CodenameOne implicit intent for sensitive communicationCodenameOne · com.codenameone:codenameone-core
- CVE-2015-10077webbuilders-group silverstripe-kapost-bridge KapostService.php getPreview sql injectionwebbuilders-group silverstripe-kapost-bridge · webbuilders-…
- CVE-2023-24573 Dell Command | Monitor versions prior to 10.9 contain an arbitrary folder delete vulnerability during uninstallation.Dell Command Monitor
- CVE-2023-23698 Dell Command | Update, Dell Update, and Alienware Update versions before 4.6.0 and 4.7.1 contain Insecure Operation on Windows Junction in Dell Command Update
- CVE-2018-7935 There is a vulnerability in 21.328.01.00.00 version of the E5573Cs-322.Huawei E5573Cs-322
- CVE-2022-24410 Dell BIOS contains an information exposure vulnerability.Dell CPG BIOS
- CVE-2022-34454Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a heap-based buffer overflow.Dell PowerScale OneFS
- CVE-2022-34452 PowerPath Management Appliance with versions 3.3, 3.2*, 3.1 & 3.0* contains sensitive information disclosure vulnerability.Dell PowerPath Management Appliance
- CVE-2022-44261Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-46650Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials ALEOS
- CVE-2023-23161A reflected cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web
- CVE-2023-23162Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at product.php.
- CVE-2023-23163Art Gallery Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter.
- CVE-2023-23286Cross Site Scripting (XSS) vulnerability in Provide server 14.4 allows attackers to execute arbitrary code through the server-log via userna
- CVE-2023-24230A stored cross-site scripting (XSS) vulnerability in the component /formwork/panel/dashboard of Formwork v1.12.1 allows attackers to executegetformwork/formwork
- CVE-2023-24231A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/categories.php of Inventory Management S
- CVE-2023-24232A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/product.php of Inventory Management Syst
- CVE-2023-24233A stored cross-site scripting (XSS) vulnerability in the component /php-inventory-management-system/orders.php?o=add of Inventory Management
- CVE-2023-24234A stored cross-site scripting (XSS) vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System