CVEs published February 15, 2023
93 CVEs were published on February 15, 2023: 16 critical, 47 high.
- Published
- 93
- Critical
- 16
- High
- 47
- Medium
- 27
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- LS Electric XBC-DN32U
- 7
- SolarWinds Platform
- 6
- Artica PFMS Pandora FMS
- 4
- Media CP Media Control Panel
- 4
- Jenkins Project Jenkins Azure Credentials Plugin · org.jenk…
- 3
- Jenkins Project Jenkins Email Extension Plugin · org.jenkin…
- 3
- Netgear WNDR3700v2
- 3
- Synopsys Jenkins Coverity Plugin · org.jenkins-ci.plugins:s…
- 3
- Android
- 2
- Hasherezade (github) Libpeconv
- 2
Critical 16
- CVE-2023-22807CVE-2023-22807LS Electric XBC-DN32U
- CVE-2023-22804CVE-2023-22804LS Electric XBC-DN32U
- CVE-2023-0102CVE-2023-0102LS Electric XBC-DN32U
- CVE-2020-19825Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain eskimai/kimai
- CVE-2020-21119SQL Injection vulnerability in Kliqqi-CMS 2.0.2 in admin/admin_update_module_widgets.php in recordIDValue parameter, allows attackers to gai
- CVE-2020-21120SQL Injection vulnerability in file home\controls\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookie_
- CVE-2021-33304Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico_fragments.c in function pico_fragments_reassem
- CVE-2021-33925SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows una
- CVE-2022-46892In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex.
- CVE-2023-22855Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution.
- CVE-2023-23459Priority Windows – Command Execution via SQL Injection Priority for Windows
- CVE-2023-23460Priority Web – Authentication bypass Priority Web
- CVE-2023-23461Libpeconv – access violationHasherezade (github) Libpeconv
- CVE-2023-23462Libpeconv – integer overflowHasherezade (github) Libpeconv
- CVE-2023-23465Media CP Media Control Panel – CSRFMedia CP Media Control Panel
- CVE-2023-25765In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowiJenkins Project Jenkins Email Extension Plugin · org.jenkin…
High 47
- CVE-2023-22806CVE-2023-22806LS Electric XBC-DN32U
- CVE-2023-22803CVE-2023-22803LS Electric XBC-DN32U
- CVE-2023-0103CVE-2023-0103LS Electric XBC-DN32U
- CVE-2023-25578Starlite DoS vulnerability when parsing multipart request bodystarlite-api starlite · starlite
- CVE-2022-42735Apache ShenYu Admin ultra viresApache Software Foundation Apache ShenYu · org.apache.sheny…
- CVE-2021-34117SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, allows attackers to ga
- CVE-2021-38239SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys_ms
- CVE-2022-32469An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32470An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32471An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32473An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32474An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32475An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32476An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32477An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32478An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32953An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-32954An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 5.5.
- CVE-2022-32955An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-38111SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2022-38867SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, 4.0.2, and 4.4.x in api.go, allows attackers to execute arbitrary code.github.com/zhaojh329/rttys
- CVE-2022-38868SQL Injection vulnerability in Ehoney version 2.0.0 in models/protocol.go and models/images.go, allows attackers to execute arbitrary code.
- CVE-2022-38935An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/
- CVE-2022-40016Use After Free (UAF) vulnerability in ireader media-server before commit 3e0f63f1d3553f75c7d4eb32fa7c7a1976a9ff84 in librtmp, allows attacke
- CVE-2022-42455ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multipl
- CVE-2022-45153saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha_cluster.slsSUSE Linux Enterprise Module for SAP Applications 15-SP1… +1
- CVE-2022-45546Information Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacker to obtain credenti
- CVE-2022-47372Stored cross-site scripting vulnerability in create event sectionArtica PFMS Pandora FMS
- CVE-2022-47503SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2022-47504SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2022-47506SolarWinds Platform Directory Traversal VulnerabilitySolarWinds Platform
- CVE-2022-47507SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2022-47508Disable NTLM: SAM 2022.4 SolarWinds Server & Application Monitor
- CVE-2023-0361A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS.gnutls
- CVE-2023-20927In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass.Android
- CVE-2023-22368Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain priELECOM CO. ELECOM Camera Assistant and QuickFileDealer
- CVE-2023-22377Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to FUJITSU LIMITED tsClinical Define.xml Generator and tsClini…
- CVE-2023-23464Media CP Media Control Panel – Information DisclosureMedia CP Media Control Panel
- CVE-2023-23467Media CP Media Control Panel – Reflected XSSMedia CP Media Control Panel
- CVE-2023-23836SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2023-24498Netgear ProSAFE 24 Port 10/100 FS726TP - CWE-522: Insufficiently Protected Credentials.Netgear ProSAFE 24 Port 10/100 FS726TP
- CVE-2023-24580An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.django
- CVE-2023-25011PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administrNEC PC settings tool
- CVE-2023-25156Kiwi TCMS has no protection against brute-force attacks on login pagekiwitcms kiwi · kiwitcms
- CVE-2023-25171Kiwi TCMS has denial of service vulnerability on Password reset pagekiwitcms kiwi · kiwitcms
- CVE-2023-25191AMI MegaRAC SPX devices allow Password Disclosure through Redfish.
- CVE-2023-25767A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connJenkins Project Jenkins Azure Credentials Plugin · org.jenk…
Medium, low and unrated 30
- CVE-2023-0850Netgear WNDR3700v2 Web Interface denial of serviceNetgear WNDR3700v2
- CVE-2023-0849Netgear WNDR3700v2 Web Interface command injectionNetgear WNDR3700v2
- CVE-2023-0848Netgear WNDR3700v2 Web Management Interface denial of serviceNetgear WNDR3700v2
- CVE-2023-22805CVE-2023-22805LS Electric XBC-DN32U
- CVE-2023-0841GPAC reframe_mp3.c mp3_dmx_process heap-based overflowGPAC
- CVE-2023-0840PHPCrazy cross site scriptingPHPCrazy
- CVE-2022-25978All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on extegithub.com/usememos/memos/server · github.com/usememos/memos
- CVE-2021-33396Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbit
- CVE-2022-45154supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio_setup.shSUSE Linux Enterprise Server
- CVE-2022-45436Stored cross-site scripting vulnerability in network maps editor featureArtica PFMS Pandora FMS
- CVE-2022-45437Stored cross-site scripting vulnerability in the reporting dashboard moduleArtica PFMS Pandora FMS
- CVE-2022-45543Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or usernam
- CVE-2022-45586Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service.
- CVE-2022-45587Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service.
- CVE-2022-47373Reflected Cross Site Scripting in Search Functionality of Module LibraryArtica PFMS Pandora FMS
- CVE-2023-20949In s2mpg11_pmic_probe of s2mpg11-regulator.c, there is a possible out of bounds read due to a heap buffer overflow.Android
- CVE-2023-23458Sunell DVR – Exposure of Sensitive InformationSunell DVR
- CVE-2023-23463 Sunell DVR – Insufficiently Protected CredentialsSunell DVR
- CVE-2023-23466Media CP Media Control Panel – insufficiently protected credential changeMedia CP Media Control Panel
- CVE-2023-23847A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an atSynopsys Jenkins Coverity Plugin · org.jenkins-ci.plugins:s…
- CVE-2023-23848Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to aSynopsys Jenkins Coverity Plugin · org.jenkins-ci.plugins:s…
- CVE-2023-23850A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate Synopsys Jenkins Coverity Plugin · org.jenkins-ci.plugins:s…
- CVE-2023-24499Butterfly Button plugin may leave traces of its use on user's deviceButterfly Button plugin
- CVE-2023-25192AMI MegaRAC SPX devices allow User Enumeration through Redfish.
- CVE-2023-25761Jenkins JUnit Plugin 1166.va_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored Jenkins Project Jenkins JUnit Plugin · org.jenkins-ci.plugi…
- CVE-2023-25762Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet GenerJenkins Project Jenkins Pipeline: Build Step Plugin · org.j…
- CVE-2023-25763Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored crJenkins Project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2023-25764Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generatedJenkins Project Jenkins Email Extension Plugin · org.jenkin…
- CVE-2023-25766A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission tJenkins Project Jenkins Azure Credentials Plugin · org.jenk…
- CVE-2023-25768A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission tJenkins Project Jenkins Azure Credentials Plugin · org.jenk…