# CVEs published 2023-02-13

119 CVEs were published on February 13, 2023: 11 critical, 27 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-10079](https://cve.now/CVE-2015-10079.md): juju2143 WalrusIRC parser.js parseLinks cross site scripting (CVSS 3.5, juju2143 WalrusIRC)
- [CVE-2022-4905](https://cve.now/CVE-2022-4905.md): UDX Stateless Media Plugin class-settings.php setup\_wizard\_interface cross site scripting (CVSS 3.5, UDX Stateless Media Plugin · wpcloud/wp-stateless)
- [CVE-2023-25572](https://cve.now/CVE-2023-25572.md): React-Admin vulnerable to Cross-Site-Scripting attack on \`\<RichTextField\>\` (CVSS 5.4, marmelab react-admin · react-admin +1)
- [CVE-2023-25162](https://cve.now/CVE-2023-25162.md): Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPs (CVSS 5.3, nextcloud security-advisories)
- [CVE-2023-25161](https://cve.now/CVE-2023-25161.md): Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emails (CVSS 3.7, nextcloud security-advisories)
- [CVE-2023-25160](https://cve.now/CVE-2023-25160.md): IDOR Vulnerability in Nextcloud Mail (CVSS 4.1, nextcloud security-advisories)
- [CVE-2023-23553](https://cve.now/CVE-2023-23553.md): X-400 Cross-Site Scripting (CVSS 4.5, Control By Web X-400 devices)
- [CVE-2023-23551](https://cve.now/CVE-2023-23551.md): X-600M Code Injection (CVSS 9.1, Control By Web X-600M devices)
- [CVE-2022-41134](https://cve.now/CVE-2022-41134.md): WordPress Optinly Plugin \<= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamific…)
- [CVE-2023-25159](https://cve.now/CVE-2023-25159.md): Nextcloud Server previews are accessible without a watermark (CVSS 2.3, nextcloud security-advisories)
- [CVE-2023-23948](https://cve.now/CVE-2023-23948.md): ownCloud Android app vulnerable to SQL Injection (CVSS 6.2, ownCloud Android)
- [CVE-2022-3089](https://cve.now/CVE-2022-3089.md): EnOcean SmartServer Hard-coded credentials (CVSS 6.3, EnOcean Smartserver)
- [CVE-2023-24804](https://cve.now/CVE-2023-24804.md): ownCloud Android app vulnerable to Path Traversal (CVSS 5.0, ownCloud Android)
- [CVE-2022-4759](https://cve.now/CVE-2022-4759.md): GigPress \< 2.3.28 - Contributor+ Stored XSS via Shortcode (CVSS 6.8, GigPress)
- [CVE-2022-4562](https://cve.now/CVE-2022-4562.md): Meks Flexible Shortcodes \< 1.3.5 - Contributor+ Stored XSS (CVSS 4.6, Meks Flexible Shortcodes)
- [CVE-2023-0360](https://cve.now/CVE-2023-0360.md): Location Weather \< 1.3.4 - Contributor+ Stored XSS (CVSS 5.4, Location Weather)
- [CVE-2023-0177](https://cve.now/CVE-2023-0177.md): Social Like Box and Page by WpDevArt \< 0.8.41 - Contributor+ Stored XSS (CVSS 5.4, Social Like Box and Page by WpDevArt)
- [CVE-2022-4580](https://cve.now/CVE-2022-4580.md): Twenty20 Image Before-After \<= 1.5.9 - Contributor+ Stored XSS (CVSS 5.4, Twenty20 Image Before-After)
- [CVE-2022-4830](https://cve.now/CVE-2022-4830.md): Paid Memberships Pro \< 2.9.9 - Contributor+ Stored XSS via Shortcode (CVSS 6.1, Paid Memberships Pro)
- [CVE-2022-4471](https://cve.now/CVE-2022-4471.md): YARPP - Yet Another Related Posts Plugin \< 5.30.3 - Contributor+ Stored XSS (CVSS 6.8, YARPP)
- [CVE-2022-4488](https://cve.now/CVE-2022-4488.md): Widgets on Pages \< 1.8.0 - Contributor+ Stored XSS (CVSS 6.8, Widgets on Pages)
- [CVE-2023-0262](https://cve.now/CVE-2023-0262.md): WP Airbnb Review Slider \< 3.3 - Subscriber+ SQLi (CVSS 7.7, WP Airbnb Review Slider)
- [CVE-2022-4682](https://cve.now/CVE-2022-4682.md): Lightbox Gallery \< 0.9.5 - Contributor+ Stored XSS via Shortcode (CVSS 6.8, Lightbox Gallery)
- [CVE-2022-3891](https://cve.now/CVE-2022-3891.md): WP FullCalendar \< 1.5 - Unauthenticated Arbitrary Post Access (CVSS 5.3, WP FullCalendar)
- [CVE-2022-4745](https://cve.now/CVE-2022-4745.md): WP Customer Area \< 8.1.4 - Unauthorised Actions via CSRF (CVSS 6.1, WP Customer Area)
- [CVE-2023-0034](https://cve.now/CVE-2023-0034.md): JetWidgets For Elementor \< 1.0.14 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, JetWidgets For Elementor)
- [CVE-2023-0075](https://cve.now/CVE-2023-0075.md): Amazon JS \<= 0.10 - Contributor+ Stored XSS (CVSS 6.8, Amazon JS)
- [CVE-2023-0405](https://cve.now/CVE-2023-0405.md): GPT3 AI Content Writer \< 1.4.38 - Subscriber+ Arbitrary Post Content Update (CVSS 5.4, GPT AI Power: Content Writer & ChatGPT & Image Generator &…)
- [CVE-2023-0151](https://cve.now/CVE-2023-0151.md): uTubeVideo Gallery \< 2.0.8 - Contributor+ Stored XSS (CVSS 5.4, uTubeVideo Gallery)
- [CVE-2023-0080](https://cve.now/CVE-2023-0080.md): Customer Reviews for WooCommerce \< 5.16.0 - Contributor+ LFI (CVSS 8.8, Customer Reviews for WooCommerce)
- [CVE-2023-0255](https://cve.now/CVE-2023-0255.md): Enable Media Replace \< 4.0.2 - Author+ Arbitrary File Upload (CVSS 8.8, Enable Media Replace)
- [CVE-2023-0166](https://cve.now/CVE-2023-0166.md): PickPlugins Product Slider for WooCommerce \< 1.13.42 - Contributor+ Stored XSS (CVSS 5.4, Product Slider for WooCommerce by PickPlugins)
- [CVE-2023-0259](https://cve.now/CVE-2023-0259.md): WP Google Review Slider \< 11.8 - Subscriber+ SQLi (CVSS 8.8, WP Google Review Slider)
- [CVE-2022-4656](https://cve.now/CVE-2022-4656.md): WP Visitor Statistics (Real Time Traffic) \< 6.5 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, WP Visitor Statistics)
- [CVE-2023-0275](https://cve.now/CVE-2023-0275.md): Easy Accept Payments for PayPal \< 4.9.10 - Contributor+ Stored XSS (CVSS 5.4, Easy Accept Payments for PayPal)
- [CVE-2023-0263](https://cve.now/CVE-2023-0263.md): WP Yelp Review Slider \< 7.1 - Subscriber+ SQLi (no CVSS, WP Yelp Review Slider)
- [CVE-2022-4512](https://cve.now/CVE-2022-4512.md): Better Font Awesome \< 2.0.4 - Contributor+ Stored XSS (CVSS 6.8, Better Font Awesome)
- [CVE-2023-0098](https://cve.now/CVE-2023-0098.md): Simple URLs \< 115 - Subscriber+ SQLi (CVSS 7.7, Simple URLs)
- [CVE-2023-0061](https://cve.now/CVE-2023-0061.md): Judge.me Product Reviews for WooCommerce \< 1.3.21 - Contributor+ Stored XSS (CVSS 6.8, Judge.me Product Reviews for WooCommerce)
- [CVE-2023-0333](https://cve.now/CVE-2023-0333.md): TemplatesNext ToolKit \< 3.2.9 - Contributor+ Stored XSS (CVSS 5.4, TemplatesNext ToolKit)
- [CVE-2022-4546](https://cve.now/CVE-2022-4546.md): Mapwiz \<= 1.0.1 - Admin+ SQLi (CVSS 7.2, Mapwiz)
- [CVE-2023-0260](https://cve.now/CVE-2023-0260.md): WP Review Slider \< 12.2 - Subscriber+ SQLi (CVSS 8.8, WP Review Slider)
- [CVE-2023-0169](https://cve.now/CVE-2023-0169.md): Zoho Forms \< 3.0.1 - Contributor+ Stored XSS (CVSS 5.4, Form plugin for WordPress)
- [CVE-2022-4458](https://cve.now/CVE-2022-4458.md): Amr Shortcode Any Widget \<= 4.0 - Contributor+ Stored XSS (CVSS 5.4, amr shortcode any widget)
- [CVE-2023-0261](https://cve.now/CVE-2023-0261.md): WP TripAdvisor Review Slider \< 10.8 - Subscriber+ SQLi (CVSS 8.8, WP TripAdvisor Review Slider)
- [CVE-2023-0373](https://cve.now/CVE-2023-0373.md): Lightweight Accordion \< 1.5.15 - Contributor+ Stored XSS (CVSS 5.4, Lightweight Accordion)
- [CVE-2022-4551](https://cve.now/CVE-2022-4551.md): Rich Table of Contents \< 1.3.9 - Contributor+ Stored XSS (CVSS 5.4, Rich Table of Contents)
- [CVE-2023-0220](https://cve.now/CVE-2023-0220.md): Pinpoint Booking System \< 2.9.9.2.9 - Subscriber+ SQLi (CVSS 8.8, Pinpoint Booking System)
- [CVE-2022-4678](https://cve.now/CVE-2022-4678.md): TemplatesNext ToolKit \< 3.2.8 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, TemplatesNext ToolKit)
- [CVE-2023-0060](https://cve.now/CVE-2023-0060.md): Responsive Gallery Grid \< 2.3.9 - Contributor+ Stored XSS (CVSS 5.4, Responsive Gallery Grid)
- [CVE-2023-0099](https://cve.now/CVE-2023-0099.md): Simple URLs \< 115 - Multiple Reflected XSS (no CVSS, Simple URLs)
- [CVE-2022-4448](https://cve.now/CVE-2022-4448.md): GiveWP \< 2.24.0 - Contributor+ Stored XSS (CVSS 5.4, GiveWP)
- [CVE-2022-4628](https://cve.now/CVE-2022-4628.md): Easy PayPal Buy Now Button \< 1.7.4 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, Easy PayPal Buy Now Button)
- [CVE-2023-0159](https://cve.now/CVE-2023-0159.md): Extensive VC Addons for WPBakery page builder \< 1.9.1 - Unauthenticated RCE (no CVSS, Extensive VC Addons for WPBakery page builder)
- [CVE-2023-0270](https://cve.now/CVE-2023-0270.md): YaMaps for WordPress Plugin \< 0.6.26 - Contributor+ Stored XSS (CVSS 5.4, YaMaps for WordPress Plugin)
- [CVE-2023-0362](https://cve.now/CVE-2023-0362.md): Themify Portfolio Post \< 1.2.2 - Contributor+ Stored XSS (CVSS 5.4, Themify Portfolio Post)
- [CVE-2022-4445](https://cve.now/CVE-2022-4445.md): FL3R FeelBox \<= 8.1 - Unauthenticated SQLi (CVSS 9.8, FL3R FeelBox)
- [CVE-2022-4783](https://cve.now/CVE-2022-4783.md): Youtube Channel Gallery \<= 2.4 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Youtube Channel Gallery)
- [CVE-2023-0379](https://cve.now/CVE-2023-0379.md): Spotlight Social Feeds \< 1.4.3 - Contributor+ Stored XSS (CVSS 5.4, Spotlight Social Feeds \[Block, Shortcode, and Widget\])
- [CVE-2022-4473](https://cve.now/CVE-2022-4473.md): Widget Shortcode \<= 0.3.5 - Contributor+ Stored XSS (CVSS 5.4, Widget Shortcode)
- [CVE-2023-0808](https://cve.now/CVE-2023-0808.md): Deye/Revolt/Bosswerk Inverter Access Point Setting hard-coded password (CVSS 3.9, Deye Inverter · Revolt Inverter +1)
- [CVE-2022-45455](https://cve.now/CVE-2022-45455.md): Local privilege escalation due to incomplete uninstallation cleanup. (CVSS 6.6, Acronis Cyber Protect Home Office · Acronis Agent +1)
- [CVE-2022-45454](https://cve.now/CVE-2022-45454.md): Sensitive information disclosure due to insecure folder permissions. (CVSS 2.2, Acronis Agent · Acronis Cyber Protect)
- [CVE-2022-34397](https://cve.now/CVE-2022-34397.md): Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass (CVSS 6.9, Dell Unisphere for PowerMax)
- [CVE-2023-23697](https://cve.now/CVE-2023-23697.md): Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation. (CVSS 4.7, Dell Command Update)
- [CVE-2023-24572](https://cve.now/CVE-2023-24572.md): Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during uninstall (CVSS 4.7, Dell Command Integration Suite for System Center)
- [CVE-2022-25937](https://cve.now/CVE-2022-25937.md): Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root di (CVSS 6.5, glance)
- [CVE-2022-3411](https://cve.now/CVE-2022-3411.md): A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allow (CVSS 6.5, GitLab)
- [CVE-2022-3759](https://cve.now/CVE-2022-3759.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before (CVSS 4.3, GitLab)
- [CVE-2022-40022](https://cve.now/CVE-2022-40022.md): Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. (CVSS 9.8)
- [CVE-2022-4138](https://cve.now/CVE-2022-4138.md): A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 (CVSS 6.4, GitLab)
- [CVE-2022-43460](https://cve.now/CVE-2022-43460.md): Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format. (CVSS 7.5, FUJIFILM Business Innovation Driver Distributor)
- [CVE-2022-45285](https://cve.now/CVE-2022-45285.md): Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2022-45724](https://cve.now/CVE-2022-45724.md): Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an (CVSS 5.4)
- [CVE-2022-45725](https://cve.now/CVE-2022-45725.md): Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the (CVSS 8.8)
- [CVE-2022-45962](https://cve.now/CVE-2022-45962.md): Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php. (CVSS 6.5)
- [CVE-2022-47034](https://cve.now/CVE-2022-47034.md): A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication. (CVSS 9.8)
- [CVE-2022-48077](https://cve.now/CVE-2022-48077.md): Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute a (CVSS 7.8)
- [CVE-2022-48110](https://cve.now/CVE-2022-48110.md): CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. (CVSS 6.1)
- [CVE-2022-48322](https://cve.now/CVE-2022-48322.md): NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. (CVSS 9.8)
- [CVE-2022-48323](https://cve.now/CVE-2022-48323.md): Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. (CVSS 9.8)
- [CVE-2023-0518](https://cve.now/CVE-2023-0518.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before (CVSS 4.3, GitLab)
- [CVE-2023-0795](https://cve.now/CVE-2023-0795.md): LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a crafted (CVSS 6.8, libtiff)
- [CVE-2023-0796](https://cve.now/CVE-2023-0796.md): LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a crafted (CVSS 6.8, libtiff)
- [CVE-2023-0797](https://cve.now/CVE-2023-0797.md): LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif\_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921, a (CVSS 6.8, libtiff)
- [CVE-2023-0798](https://cve.now/CVE-2023-0798.md): LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a crafted (CVSS 6.8, libtiff)
- [CVE-2023-0799](https://cve.now/CVE-2023-0799.md): LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a crafted (CVSS 6.8, libtiff)
- [CVE-2023-0800](https://cve.now/CVE-2023-0800.md): LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a crafted (CVSS 6.8, libtiff)
- [CVE-2023-0801](https://cve.now/CVE-2023-0801.md): LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif\_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6778, (CVSS 6.8, libtiff)
- [CVE-2023-0802](https://cve.now/CVE-2023-0802.md): LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a crafted (CVSS 6.8, libtiff)
- [CVE-2023-0803](https://cve.now/CVE-2023-0803.md): LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a crafted (CVSS 6.8, libtiff)
- [CVE-2023-0804](https://cve.now/CVE-2023-0804.md): LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a crafted (CVSS 6.8, libtiff)
- [CVE-2023-0810](https://cve.now/CVE-2023-0810.md): Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserver (CVSS 8.8, btcpayserver/btcpayserver)
- [CVE-2023-0817](https://cve.now/CVE-2023-0817.md): Buffer Over-read in gpac/gpac (CVSS 7.3, gpac/gpac)
- [CVE-2023-0818](https://cve.now/CVE-2023-0818.md): Off-by-one Error in gpac/gpac (CVSS 7.1, gpac/gpac)
- [CVE-2023-0819](https://cve.now/CVE-2023-0819.md): Heap-based Buffer Overflow in gpac/gpac (CVSS 7.8, gpac/gpac)
- [CVE-2023-22345](https://cve.now/CVE-2023-22345.md): Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process wh (CVSS 7.8, JTEKT ELECTRONICS Screen Creator Advance)
- [CVE-2023-22346](https://cve.now/CVE-2023-22346.md): Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifie (CVSS 7.8, JTEKT ELECTRONICS Screen Creator Advance)
- [CVE-2023-22347](https://cve.now/CVE-2023-22347.md): Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifie (CVSS 7.8, JTEKT ELECTRONICS Screen Creator Advance)
- [CVE-2023-22349](https://cve.now/CVE-2023-22349.md): Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifie (CVSS 7.8, JTEKT ELECTRONICS Screen Creator Advance)
- [CVE-2023-22350](https://cve.now/CVE-2023-22350.md): Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifie (CVSS 7.8, JTEKT ELECTRONICS Screen Creator Advance)
- [CVE-2023-22353](https://cve.now/CVE-2023-22353.md): Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be verifie (CVSS 7.8, JTEKT ELECTRONICS Screen Creator Advance)
- [CVE-2023-22360](https://cve.now/CVE-2023-22360.md): Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even w (CVSS 7.8, JTEKT ELECTRONICS Screen Creator Advance)
- [CVE-2023-22362](https://cve.now/CVE-2023-22362.md): SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information fr (CVSS 7.5, AKINDO SUSHIRO CO. SUSHIRO App for Android)
- [CVE-2023-22367](https://cve.now/CVE-2023-22367.md): Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates, which (CVSS 5.9, Betrend Corporation and ICHIRAN Ichiran App for iOS and Ich…)
- [CVE-2023-22854](https://cve.now/CVE-2023-22854.md): The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download a (CVSS 9.1)
- [CVE-2023-24084](https://cve.now/CVE-2023-24084.md): ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load\_file function. (CVSS 9.8)
- [CVE-2023-24086](https://cve.now/CVE-2023-24086.md): SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /customs/loan\_by\_class.php?rep (CVSS 6.1)
- [CVE-2023-24188](https://cve.now/CVE-2023-24188.md): ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to b (CVSS 9.1, com.bstek.ureport:ureport2-core)
- [CVE-2023-24619](https://cve.now/CVE-2023-24619.md): Redpanda before 22.3.12 discloses cleartext AWS credentials. (CVSS 5.5)
- [CVE-2023-24646](https://cve.now/CVE-2023-24646.md): An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute arbitra (CVSS 9.8)
- [CVE-2023-24647](https://cve.now/CVE-2023-24647.md): Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter. (CVSS 7.5)
- [CVE-2023-24648](https://cve.now/CVE-2023-24648.md): Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php. (CVSS 6.1)
- [CVE-2023-25240](https://cve.now/CVE-2023-25240.md): An improper SameSite Attribute vulnerability in pimCore v10.5.15 allows attackers to execute arbitrary code. (CVSS 8.8, pimcore/pimcore)
- [CVE-2023-25241](https://cve.now/CVE-2023-25241.md): bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter. (CVSS 6.1)
- [CVE-2023-25717](https://cve.now/CVE-2023-25717.md): Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin (CVSS 9.8, KEV)
- [CVE-2023-25718](https://cve.now/CVE-2023-25718.md): In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can (no CVSS)
- [CVE-2023-25719](https://cve.now/CVE-2023-25719.md): ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWi (CVSS 8.8)
- [CVE-2023-25727](https://cve.now/CVE-2023-25727.md): In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the drag-an (CVSS 5.4, phpmyadmin/phpmyadmin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.