# CVEs published 2023-02-15

93 CVEs were published on February 15, 2023: 16 critical, 47 high. Days are UTC.

- [CVE-2023-0850](https://cve.now/CVE-2023-0850.md): Netgear WNDR3700v2 Web Interface denial of service (CVSS 2.7, Netgear WNDR3700v2)
- [CVE-2023-0849](https://cve.now/CVE-2023-0849.md): Netgear WNDR3700v2 Web Interface command injection (CVSS 4.7, Netgear WNDR3700v2)
- [CVE-2023-0848](https://cve.now/CVE-2023-0848.md): Netgear WNDR3700v2 Web Management Interface denial of service (CVSS 5.3, Netgear WNDR3700v2)
- [CVE-2023-22807](https://cve.now/CVE-2023-22807.md): CVE-2023-22807 (CVSS 9.8, LS Electric XBC-DN32U)
- [CVE-2023-22806](https://cve.now/CVE-2023-22806.md): CVE-2023-22806 (CVSS 7.5, LS Electric XBC-DN32U)
- [CVE-2023-22805](https://cve.now/CVE-2023-22805.md): CVE-2023-22805 (CVSS 6.5, LS Electric XBC-DN32U)
- [CVE-2023-22804](https://cve.now/CVE-2023-22804.md): CVE-2023-22804 (CVSS 9.1, LS Electric XBC-DN32U)
- [CVE-2023-22803](https://cve.now/CVE-2023-22803.md): CVE-2023-22803 (CVSS 7.5, LS Electric XBC-DN32U)
- [CVE-2023-0103](https://cve.now/CVE-2023-0103.md): CVE-2023-0103 (CVSS 7.5, LS Electric XBC-DN32U)
- [CVE-2023-0102](https://cve.now/CVE-2023-0102.md): CVE-2023-0102 (CVSS 9.1, LS Electric XBC-DN32U)
- [CVE-2023-25578](https://cve.now/CVE-2023-25578.md): Starlite DoS vulnerability when parsing multipart request body (CVSS 7.5, starlite-api starlite · starlite)
- [CVE-2023-0841](https://cve.now/CVE-2023-0841.md): GPAC reframe\_mp3.c mp3\_dmx\_process heap-based overflow (CVSS 6.3, GPAC)
- [CVE-2023-0840](https://cve.now/CVE-2023-0840.md): PHPCrazy cross site scripting (CVSS 3.5, PHPCrazy)
- [CVE-2022-42735](https://cve.now/CVE-2022-42735.md): Apache ShenYu Admin ultra vires (CVSS 8.8, Apache Software Foundation Apache ShenYu · org.apache.sheny…)
- [CVE-2022-25978](https://cve.now/CVE-2022-25978.md): All versions of the package github.com/usememos/memos/server are vulnerable to Cross-site Scripting (XSS) due to insufficient checks on exte (CVSS 5.4, github.com/usememos/memos/server · github.com/usememos/memos)
- [CVE-2020-19825](https://cve.now/CVE-2020-19825.md): Cross Site Scripting (XSS) vulnerability in kevinpapst kimai2 1.30.0 in /src/Twig/Runtime/MarkdownExtension.php, allows attackers to gain es (CVSS 9.6, kimai/kimai)
- [CVE-2020-21119](https://cve.now/CVE-2020-21119.md): SQL Injection vulnerability in Kliqqi-CMS 2.0.2 in admin/admin\_update\_module\_widgets.php in recordIDValue parameter, allows attackers to gai (CVSS 9.8)
- [CVE-2020-21120](https://cve.now/CVE-2020-21120.md): SQL Injection vulnerability in file home\\controls\\cart.class.php in UQCMS 2.1.3, allows attackers execute arbitrary commands via the cookie\_ (CVSS 9.8)
- [CVE-2021-33304](https://cve.now/CVE-2021-33304.md): Double Free vulnerability in virtualsquare picoTCP v1.7.0 and picoTCP-NG v2.1 in modules/pico\_fragments.c in function pico\_fragments\_reassem (CVSS 9.8)
- [CVE-2021-33396](https://cve.now/CVE-2021-33396.md): Cross Site Request Forgery (CSRF) vulnerability in baijiacms 4.1.4, allows attackers to change the password or other information of an arbit (CVSS 6.5)
- [CVE-2021-33925](https://cve.now/CVE-2021-33925.md): SQL Injection vulnerability in nitinparashar30 cms-corephp through commit bdabe52ef282846823bda102728a35506d0ec8f9 (May 19, 2021) allows una (CVSS 9.8)
- [CVE-2021-34117](https://cve.now/CVE-2021-34117.md): SQL Injection vulnerability in SEO Panel 4.9.0 in api/user.api.php in function getUserName in the username parameter, allows attackers to ga (CVSS 7.5)
- [CVE-2021-38239](https://cve.now/CVE-2021-38239.md): SQL Injection vulnerability in dataease before 1.2.0, allows attackers to gain sensitive information via the orders parameter to /api/sys\_ms (CVSS 7.5)
- [CVE-2022-32469](https://cve.now/CVE-2022-32469.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32470](https://cve.now/CVE-2022-32470.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32471](https://cve.now/CVE-2022-32471.md): An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32473](https://cve.now/CVE-2022-32473.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32474](https://cve.now/CVE-2022-32474.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32475](https://cve.now/CVE-2022-32475.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32476](https://cve.now/CVE-2022-32476.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32477](https://cve.now/CVE-2022-32477.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32478](https://cve.now/CVE-2022-32478.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32953](https://cve.now/CVE-2022-32953.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-32954](https://cve.now/CVE-2022-32954.md): An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 5.5. (CVSS 7.0)
- [CVE-2022-32955](https://cve.now/CVE-2022-32955.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 7.0)
- [CVE-2022-38111](https://cve.now/CVE-2022-38111.md): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2022-38867](https://cve.now/CVE-2022-38867.md): SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, 4.0.2, and 4.4.x in api.go, allows attackers to execute arbitrary code. (CVSS 8.8, github.com/zhaojh329/rttys)
- [CVE-2022-38868](https://cve.now/CVE-2022-38868.md): SQL Injection vulnerability in Ehoney version 2.0.0 in models/protocol.go and models/images.go, allows attackers to execute arbitrary code. (CVSS 7.2)
- [CVE-2022-38935](https://cve.now/CVE-2022-38935.md): An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/ (CVSS 8.8)
- [CVE-2022-40016](https://cve.now/CVE-2022-40016.md): Use After Free (UAF) vulnerability in ireader media-server before commit 3e0f63f1d3553f75c7d4eb32fa7c7a1976a9ff84 in librtmp, allows attacke (CVSS 7.5)
- [CVE-2022-42455](https://cve.now/CVE-2022-42455.md): ASUS EC Tool driver (aka d.sys) 1beb15c90dcf7a5234ed077833a0a3e900969b60be1d04fcebce0a9f8994bdbb, as signed by ASUS and shipped with multipl (CVSS 7.8)
- [CVE-2022-45153](https://cve.now/CVE-2022-45153.md): saphanabootstrap-formula: Escalation to root for arbitrary users in hana/ha\_cluster.sls (CVSS 7.0, SUSE Linux Enterprise Module for SAP Applications 15-SP1… +1)
- [CVE-2022-45154](https://cve.now/CVE-2022-45154.md): supportconfig does not remove passwords in /etc/iscsi/iscsid.conf and /etc/target/lio\_setup.sh (CVSS 4.4, SUSE Linux Enterprise Server)
- [CVE-2022-45436](https://cve.now/CVE-2022-45436.md): Stored cross-site scripting vulnerability in network maps editor feature (CVSS 6.1, Artica PFMS Pandora FMS)
- [CVE-2022-45437](https://cve.now/CVE-2022-45437.md): Stored cross-site scripting vulnerability in the reporting dashboard module (CVSS 6.5, Artica PFMS Pandora FMS)
- [CVE-2022-45543](https://cve.now/CVE-2022-45543.md): Cross site scripting (XSS) vulnerability in DiscuzX 3.4 allows attackers to execute arbitrary code via the datetline, title, tpp, or usernam (CVSS 6.1)
- [CVE-2022-45546](https://cve.now/CVE-2022-45546.md): Information Disclosure in Authentication Component of ScreenCheck BadgeMaker 2.6.2.0 application allows internal attacker to obtain credenti (CVSS 7.5)
- [CVE-2022-45586](https://cve.now/CVE-2022-45586.md): Stack overflow vulnerability in function Dict::find in xpdf/Dict.cc in xpdf 4.04, allows local attackers to cause a denial of service. (CVSS 5.5)
- [CVE-2022-45587](https://cve.now/CVE-2022-45587.md): Stack overflow vulnerability in function gmalloc in goo/gmem.cc in xpdf 4.04, allows local attackers to cause a denial of service. (CVSS 5.5)
- [CVE-2022-46892](https://cve.now/CVE-2022-46892.md): In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex. (CVSS 9.8)
- [CVE-2022-47372](https://cve.now/CVE-2022-47372.md): Stored cross-site scripting vulnerability in create event section (CVSS 7.6, Artica PFMS Pandora FMS)
- [CVE-2022-47373](https://cve.now/CVE-2022-47373.md): Reflected Cross Site Scripting in Search Functionality of Module Library (CVSS 6.4, Artica PFMS Pandora FMS)
- [CVE-2022-47503](https://cve.now/CVE-2022-47503.md): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2022-47504](https://cve.now/CVE-2022-47504.md): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2022-47506](https://cve.now/CVE-2022-47506.md): SolarWinds Platform Directory Traversal Vulnerability (CVSS 7.8, SolarWinds Platform)
- [CVE-2022-47507](https://cve.now/CVE-2022-47507.md): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2022-47508](https://cve.now/CVE-2022-47508.md): Disable NTLM: SAM 2022.4 (CVSS 7.5, SolarWinds Server & Application Monitor)
- [CVE-2023-0361](https://cve.now/CVE-2023-0361.md): A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. (CVSS 7.4, gnutls)
- [CVE-2023-20927](https://cve.now/CVE-2023-20927.md): In permissions of AndroidManifest.xml, there is a possible way to grant signature permissions due to a permissions bypass. (CVSS 7.8, Android)
- [CVE-2023-20949](https://cve.now/CVE-2023-20949.md): In s2mpg11\_pmic\_probe of s2mpg11-regulator.c, there is a possible out of bounds read due to a heap buffer overflow. (CVSS 5.5, Android)
- [CVE-2023-22368](https://cve.now/CVE-2023-22368.md): Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain pri (CVSS 7.8, ELECOM CO. ELECOM Camera Assistant and QuickFileDealer)
- [CVE-2023-22377](https://cve.now/CVE-2023-22377.md): Improper restriction of XML external entity reference (XXE) vulnerability exists in tsClinical Define.xml Generator all versions (v1.0.0 to (CVSS 7.4, FUJITSU LIMITED tsClinical Define.xml Generator and tsClini…)
- [CVE-2023-22855](https://cve.now/CVE-2023-22855.md): Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. (CVSS 9.8)
- [CVE-2023-23458](https://cve.now/CVE-2023-23458.md): Sunell DVR – Exposure of Sensitive Information (CVSS 6.5, Sunell DVR)
- [CVE-2023-23459](https://cve.now/CVE-2023-23459.md): Priority Windows – Command Execution via SQL Injection (CVSS 9.1, Priority for Windows)
- [CVE-2023-23460](https://cve.now/CVE-2023-23460.md): Priority Web – Authentication bypass (CVSS 9.1, Priority Web)
- [CVE-2023-23461](https://cve.now/CVE-2023-23461.md): Libpeconv – access violation (CVSS 9.8, Hasherezade (github) Libpeconv)
- [CVE-2023-23462](https://cve.now/CVE-2023-23462.md): Libpeconv – integer overflow (CVSS 9.8, Hasherezade (github) Libpeconv)
- [CVE-2023-23463](https://cve.now/CVE-2023-23463.md): Sunell DVR – Insufficiently Protected Credentials (CVSS 5.3, Sunell DVR)
- [CVE-2023-23464](https://cve.now/CVE-2023-23464.md): Media CP Media Control Panel – Information Disclosure (CVSS 8.1, Media CP Media Control Panel)
- [CVE-2023-23465](https://cve.now/CVE-2023-23465.md): Media CP Media Control Panel – CSRF (CVSS 9.1, Media CP Media Control Panel)
- [CVE-2023-23466](https://cve.now/CVE-2023-23466.md): Media CP Media Control Panel – insufficiently protected credential change (CVSS 6.5, Media CP Media Control Panel)
- [CVE-2023-23467](https://cve.now/CVE-2023-23467.md): Media CP Media Control Panel – Reflected XSS (CVSS 8.1, Media CP Media Control Panel)
- [CVE-2023-23836](https://cve.now/CVE-2023-23836.md): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2023-23847](https://cve.now/CVE-2023-23847.md): A cross-site request forgery (CSRF) vulnerability in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers to connect to an at (CVSS 3.5, Synopsys Jenkins Coverity Plugin · org.jenkins-ci.plugins:s…)
- [CVE-2023-23848](https://cve.now/CVE-2023-23848.md): Missing permission checks in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allow attackers with Overall/Read permission to connect to a (CVSS 4.3, Synopsys Jenkins Coverity Plugin · org.jenkins-ci.plugins:s…)
- [CVE-2023-23850](https://cve.now/CVE-2023-23850.md): A missing permission check in Synopsys Jenkins Coverity Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate (CVSS 4.3, Synopsys Jenkins Coverity Plugin · org.jenkins-ci.plugins:s…)
- [CVE-2023-24498](https://cve.now/CVE-2023-24498.md): Netgear ProSAFE 24 Port 10/100 FS726TP - CWE-522: Insufficiently Protected Credentials. (CVSS 7.5, Netgear ProSAFE 24 Port 10/100 FS726TP)
- [CVE-2023-24499](https://cve.now/CVE-2023-24499.md): Butterfly Button plugin may leave traces of its use on user's device (CVSS 4.3, Butterfly Button plugin)
- [CVE-2023-24580](https://cve.now/CVE-2023-24580.md): An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7. (CVSS 7.5, django)
- [CVE-2023-25011](https://cve.now/CVE-2023-25011.md): PC settings tool Ver10.1.26.0 and earlier, PC settings tool Ver11.0.22.0 and earlier allows a attacker to write to the registry as administr (CVSS 7.8, NEC PC settings tool)
- [CVE-2023-25156](https://cve.now/CVE-2023-25156.md): Kiwi TCMS has no protection against brute-force attacks on login page (CVSS 7.5, kiwitcms kiwi · kiwitcms)
- [CVE-2023-25171](https://cve.now/CVE-2023-25171.md): Kiwi TCMS has denial of service vulnerability on Password reset page (CVSS 7.5, kiwitcms kiwi · kiwitcms)
- [CVE-2023-25191](https://cve.now/CVE-2023-25191.md): AMI MegaRAC SPX devices allow Password Disclosure through Redfish. (CVSS 7.5)
- [CVE-2023-25192](https://cve.now/CVE-2023-25192.md): AMI MegaRAC SPX devices allow User Enumeration through Redfish. (CVSS 5.3)
- [CVE-2023-25761](https://cve.now/CVE-2023-25761.md): Jenkins JUnit Plugin 1166.va\_436e268e972 and earlier does not escape test case class names in JavaScript expressions, resulting in a stored (CVSS 5.4, Jenkins Project Jenkins JUnit Plugin · org.jenkins-ci.plugi…)
- [CVE-2023-25762](https://cve.now/CVE-2023-25762.md): Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Gener (CVSS 5.4, Jenkins Project Jenkins Pipeline: Build Step Plugin · org.j…)
- [CVE-2023-25763](https://cve.now/CVE-2023-25763.md): Jenkins Email Extension Plugin 2.93 and earlier does not escape various fields included in bundled email templates, resulting in a stored cr (CVSS 5.4, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2023-25764](https://cve.now/CVE-2023-25764.md): Jenkins Email Extension Plugin 2.93 and earlier does not escape, sanitize, or sandbox rendered email template output or log output generated (CVSS 5.4, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2023-25765](https://cve.now/CVE-2023-25765.md): In Jenkins Email Extension Plugin 2.93 and earlier, templates defined inside a folder were not subject to Script Security protection, allowi (CVSS 9.9, Jenkins Project Jenkins Email Extension Plugin · org.jenkin…)
- [CVE-2023-25766](https://cve.now/CVE-2023-25766.md): A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission t (CVSS 4.3, Jenkins Project Jenkins Azure Credentials Plugin · org.jenk…)
- [CVE-2023-25767](https://cve.now/CVE-2023-25767.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to conn (CVSS 8.8, Jenkins Project Jenkins Azure Credentials Plugin · org.jenk…)
- [CVE-2023-25768](https://cve.now/CVE-2023-25768.md): A missing permission check in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers with Overall/Read permission t (CVSS 6.5, Jenkins Project Jenkins Azure Credentials Plugin · org.jenk…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.