CVEs published February 13, 2023
119 CVEs were published on February 13, 2023: 11 critical, 27 high. 1 is now in CISA KEV.
- Published
- 119
- Critical
- 11
- High
- 27
- Medium
- 71
- Low
- 6
- Unrated
- 4
- Now in CISA KEV
- 1
- Fix available
- 66
Most affected products
- libtiff
- 10
- JTEKT ELECTRONICS Screen Creator Advance
- 7
- GitLab
- 4
- nextcloud security-advisories
- 4
- gpac/gpac
- 3
- ownCloud Android
- 2
- Simple URLs
- 2
- TemplatesNext ToolKit
- 2
- Acronis Agent · Acronis Cyber Protect
- 1
- Acronis Cyber Protect Home Office · Acronis Agent +1
- 1
Critical 11
- CVE-2023-23551X-600M Code InjectionControl By Web X-600M devices
- CVE-2022-4445FL3R FeelBox <= 8.1 - Unauthenticated SQLiFL3R FeelBox
- CVE-2022-40022Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
- CVE-2022-47034A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.
- CVE-2022-48322NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability.
- CVE-2022-48323Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue.
- CVE-2023-22854The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download a
- CVE-2023-24084ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load_file function.
- CVE-2023-24188ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to bcom.bstek.ureport:ureport2-core
- CVE-2023-24646An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitra
- CVE-2023-25717Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin
High 27
- CVE-2023-0262WP Airbnb Review Slider < 3.3 - Subscriber+ SQLiWP Airbnb Review Slider
- CVE-2023-0080Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFICustomer Reviews for WooCommerce
- CVE-2023-0255Enable Media Replace < 4.0.2 - Author+ Arbitrary File UploadEnable Media Replace
- CVE-2023-0259WP Google Review Slider < 11.8 - Subscriber+ SQLiWP Google Review Slider
- CVE-2023-0098Simple URLs < 115 - Subscriber+ SQLiSimple URLs
- CVE-2022-4546Mapwiz <= 1.0.1 - Admin+ SQLiMapwiz
- CVE-2023-0260WP Review Slider < 12.2 - Subscriber+ SQLiWP Review Slider
- CVE-2023-0261WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLiWP TripAdvisor Review Slider
- CVE-2023-0220Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLiPinpoint Booking System
- CVE-2022-43460Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format.FUJIFILM Business Innovation Driver Distributor
- CVE-2022-45725Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the
- CVE-2022-48077Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute a
- CVE-2023-0810Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverbtcpayserver/btcpayserver
- CVE-2023-0817Buffer Over-read in gpac/gpacgpac/gpac
- CVE-2023-0818Off-by-one Error in gpac/gpacgpac/gpac
- CVE-2023-0819Heap-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-22345Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process whJTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22346Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifieJTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22347Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifieJTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22349Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifieJTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22350Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifieJTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22353Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifieJTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22360Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even wJTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22362SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information frAKINDO SUSHIRO CO. SUSHIRO App for Android
- CVE-2023-24647Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.
- CVE-2023-25240An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code.pimcore/pimcore
- CVE-2023-25719ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWi
Medium, low and unrated 81
- CVE-2015-10079juju2143 WalrusIRC parser.js parseLinks cross site scriptingjuju2143 WalrusIRC
- CVE-2022-4905UDX Stateless Media Plugin class-settings.php setup_wizard_interface cross site scriptingUDX Stateless Media Plugin · wpcloud/wp-stateless
- CVE-2023-25572React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`marmelab react-admin · react-admin +1
- CVE-2023-25162Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPsnextcloud security-advisories
- CVE-2023-25161Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emailsnextcloud security-advisories
- CVE-2023-25160IDOR Vulnerability in Nextcloud Mailnextcloud security-advisories
- CVE-2023-23553X-400 Cross-Site ScriptingControl By Web X-400 devices
- CVE-2022-41134WordPress Optinly Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF)OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamific…
- CVE-2023-25159Nextcloud Server previews are accessible without a watermarknextcloud security-advisories
- CVE-2023-23948ownCloud Android app vulnerable to SQL InjectionownCloud Android
- CVE-2022-3089EnOcean SmartServer Hard-coded credentialsEnOcean Smartserver
- CVE-2023-24804ownCloud Android app vulnerable to Path TraversalownCloud Android
- CVE-2022-4759GigPress < 2.3.28 - Contributor+ Stored XSS via ShortcodeGigPress
- CVE-2022-4562Meks Flexible Shortcodes < 1.3.5 - Contributor+ Stored XSSMeks Flexible Shortcodes
- CVE-2023-0360Location Weather < 1.3.4 - Contributor+ Stored XSSLocation Weather
- CVE-2023-0177Social Like Box and Page by WpDevArt < 0.8.41 - Contributor+ Stored XSSSocial Like Box and Page by WpDevArt
- CVE-2022-4580Twenty20 Image Before-After <= 1.5.9 - Contributor+ Stored XSSTwenty20 Image Before-After
- CVE-2022-4830Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via ShortcodePaid Memberships Pro
- CVE-2022-4471YARPP - Yet Another Related Posts Plugin < 5.30.3 - Contributor+ Stored XSSYARPP
- CVE-2022-4488Widgets on Pages < 1.8.0 - Contributor+ Stored XSSWidgets on Pages
- CVE-2022-4682Lightbox Gallery < 0.9.5 - Contributor+ Stored XSS via ShortcodeLightbox Gallery
- CVE-2022-3891WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post AccessWP FullCalendar
- CVE-2022-4745WP Customer Area < 8.1.4 - Unauthorised Actions via CSRFWP Customer Area
- CVE-2023-0034JetWidgets For Elementor < 1.0.14 - Contributor+ Stored XSS via ShortcodeJetWidgets For Elementor
- CVE-2023-0075Amazon JS <= 0.10 - Contributor+ Stored XSSAmazon JS
- CVE-2023-0405GPT3 AI Content Writer < 1.4.38 - Subscriber+ Arbitrary Post Content UpdateGPT AI Power: Content Writer & ChatGPT & Image Generator &…
- CVE-2023-0151uTubeVideo Gallery < 2.0.8 - Contributor+ Stored XSSuTubeVideo Gallery
- CVE-2023-0166PickPlugins Product Slider for WooCommerce < 1.13.42 - Contributor+ Stored XSSProduct Slider for WooCommerce by PickPlugins
- CVE-2022-4656WP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via ShortcodeWP Visitor Statistics
- CVE-2023-0275Easy Accept Payments for PayPal < 4.9.10 - Contributor+ Stored XSSEasy Accept Payments for PayPal
- CVE-2023-0263WP Yelp Review Slider < 7.1 - Subscriber+ SQLiWP Yelp Review Slider
- CVE-2022-4512Better Font Awesome < 2.0.4 - Contributor+ Stored XSSBetter Font Awesome
- CVE-2023-0061Judge.me Product Reviews for WooCommerce < 1.3.21 - Contributor+ Stored XSSJudge.me Product Reviews for WooCommerce
- CVE-2023-0333TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSSTemplatesNext ToolKit
- CVE-2023-0169Zoho Forms < 3.0.1 - Contributor+ Stored XSSForm plugin for WordPress
- CVE-2022-4458Amr Shortcode Any Widget <= 4.0 - Contributor+ Stored XSSamr shortcode any widget
- CVE-2023-0373Lightweight Accordion < 1.5.15 - Contributor+ Stored XSSLightweight Accordion
- CVE-2022-4551Rich Table of Contents < 1.3.9 - Contributor+ Stored XSSRich Table of Contents
- CVE-2022-4678TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via ShortcodeTemplatesNext ToolKit
- CVE-2023-0060Responsive Gallery Grid < 2.3.9 - Contributor+ Stored XSSResponsive Gallery Grid
- CVE-2023-0099Simple URLs < 115 - Multiple Reflected XSSSimple URLs
- CVE-2022-4448GiveWP < 2.24.0 - Contributor+ Stored XSSGiveWP
- CVE-2022-4628Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in ShortcodeEasy PayPal Buy Now Button
- CVE-2023-0159 Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCEExtensive VC Addons for WPBakery page builder
- CVE-2023-0270YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSSYaMaps for WordPress Plugin
- CVE-2023-0362Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSSThemify Portfolio Post
- CVE-2022-4783Youtube Channel Gallery <= 2.4 - Contributor+ Stored XSS via ShortcodeYoutube Channel Gallery
- CVE-2023-0379Spotlight Social Feeds < 1.4.3 - Contributor+ Stored XSSSpotlight Social Feeds [Block, Shortcode, and Widget]
- CVE-2022-4473Widget Shortcode <= 0.3.5 - Contributor+ Stored XSSWidget Shortcode
- CVE-2023-0808Deye/Revolt/Bosswerk Inverter Access Point Setting hard-coded passwordDeye Inverter · Revolt Inverter +1
- CVE-2022-45455Local privilege escalation due to incomplete uninstallation cleanup.Acronis Cyber Protect Home Office · Acronis Agent +1
- CVE-2022-45454Sensitive information disclosure due to insecure folder permissions.Acronis Agent · Acronis Cyber Protect
- CVE-2022-34397 Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypassDell Unisphere for PowerMax
- CVE-2023-23697Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation.Dell Command Update
- CVE-2023-24572 Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstallDell Command Integration Suite for System Center
- CVE-2022-25937Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root diglance
- CVE-2022-3411A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allowGitLab
- CVE-2022-3759An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 beforeGitLab
- CVE-2022-4138A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7GitLab
- CVE-2022-45285Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-45724Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an
- CVE-2022-45962Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php.
- CVE-2022-48110CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget.
- CVE-2023-0518An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 beforeGitLab
- CVE-2023-0795LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted libtiff
- CVE-2023-0796LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted libtiff
- CVE-2023-0797LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, alibtiff
- CVE-2023-0798LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted libtiff
- CVE-2023-0799LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted libtiff
- CVE-2023-0800LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a craftedlibtiff
- CVE-2023-0801LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, libtiff
- CVE-2023-0802LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a craftedlibtiff
- CVE-2023-0803LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a craftedlibtiff
- CVE-2023-0804LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a craftedlibtiff
- CVE-2023-22367Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, whichBetrend Corporation and ICHIRAN Ichiran App for iOS and Ich…
- CVE-2023-24086SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/loan_by_class.php?rep
- CVE-2023-24619Redpanda before 22.3.12 discloses cleartext AWS credentials.
- CVE-2023-24648Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.
- CVE-2023-25241bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
- CVE-2023-25718In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can
- CVE-2023-25727In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-anphpmyadmin/phpmyadmin